CVE-2026-49853

CVE Details

Release Date:	2026-07-14
Impact:	Important	What is this?

Description

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.

See more information about CVE-2026-49853 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	7.7
Vector String:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Version:	3.1
Attack Vector:	Network
Attack Complexity:	Low
Privileges Required:	Low
User Interaction:	None
Scope:	Changed
Confidentiality Impact:	High
Integrity Impact:	None
Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 10 (python-tornado)	ELSA-2026-67147-0	2026-09-14
Oracle Linux version 9 (python-tornado)	ELSA-2026-67146-0	2026-09-14