UbuntuUpdates.org

Package "python-tornado-doc"

Name: python-tornado-doc

Description:

scalable, non-blocking web server and tools - documentation
Latest version: 6.5.4-0.1ubuntu0.2
Release: resolute (26.04)
Level: security
Repository: main
Head package: python-tornado
Homepage: https://www.tornadoweb.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "python-tornado-doc"

All arch deb package
APT INSTALL

Other versions of "python-tornado-doc" in Resolute

Repository Area Version
base main 6.5.4-0.1
updates main 6.5.4-0.1ubuntu0.1

Changelog

Version: 6.5.4-0.1ubuntu0.2 2026-10-22 11:16:59 UTC

python-tornado (6.5.4-0.1ubuntu0.2) resolute-security; urgency=medium

  * SECURITY UPDATE: denial of service.
    - debian/patches/CVE-2026-91990.patch: Limit the number of multipart
      parts to 100 in tornado/httputil.py. Add tests in
      tornado/test/httputil_test.py.
    - CVE-2026-91990
  * SECURITY UPDATE: credential leak.
    - debian/patches/CVE-2026-91992.patch: Do not reuse curl handles across
      requests in tornado/curl_httpclient.py, so proxy credentials and client
      certificates are not leaked between requests. Add tests in
      tornado/test/curl_httpclient_test.py.
    - CVE-2026-91992
  * SECURITY UPDATE: denial of service.
    - debian/patches/CVE-2026-103262.patch: Enforce max_body_size for
      streaming responses and decompression bombs in
      tornado/curl_httpclient.py. Add tests in
      tornado/test/curl_httpclient_test.py.
    - CVE-2026-103262
  * SECURITY UPDATE: path traversal.
    - debian/patches/CVE-2026-103263.patch: Resolve symlinks before checking
      the root path in tornado/web.py, preventing access outside the static
      root. Add tests in tornado/test/web_test.py.
    - CVE-2026-103263

 -- Chrisa Oikonomou Wed, 14 Oct 2026 15:24:58 +0300
Source diff to previous version
CVE-2026-91990 Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_
CVE-2026-91992 Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper s
CVE-2026-103262 Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause den
CVE-2026-103263 Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirmi

Version: 6.5.4-0.1ubuntu0.1 2026-04-28 21:08:02 UTC

  python-tornado (6.5.4-0.1ubuntu0.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Denial of service when parsing large multipart bodies.
    - debian/patches/CVE-2026-31958.patch: Add limit of 100 parts and enforce
      checks in tornado/httputil.py. Add tests in
      tornado/test/httputil_test.py.
    - CVE-2026-31958
  * SECURITY UPDATE: Cookie attribute injection.
    - debian/patches/CVE-2026-35536.patch: Raise CookieError on invalid
      characters in tornado/web.py. Add tests in tornado/test/web_test.py.
    - CVE-2026-35536

 -- Hlib Korzhynskyy <email address hidden> Tue, 28 Apr 2026 14:38:37 -0230
CVE-2026-31958 Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts i
CVE-2026-35536 In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were n


About   -   Send Feedback to @ubuntu_updates