chore(deps): update dependency tornado to v6.5.6 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
tornado (source)	6.5.5 → 6.5.6

Review

• Updates have been tested and work
• If updates are AWS related, versions match the infrastructure (e.g. Lambda runtime, database, etc.)

---

Tornado has out-of-bounds memory access via C extension

CVE-2026-49854 / GHSA-cx3h-4qpv-8hc9

More information

Details

Summary

Tornado's optional native extension tornado.speedups implements websocket_mask without validating that the mask argument is exactly four bytes long. The C function reads four bytes from mask unconditionally, even when Python passes a shorter byte string. This can read beyond the provided buffer, exposing up to 3 bytes of uninitialized memory.

The behavior is reachable from Tornado's XSRF token decoder when xsrf_cookies=True and the native extension is active.

Mitigations

This bug is fixed in Tornado 6.5.6. Prior to upgrading to this version, setting the environment variable TORNADO_EXTENSION=0 will disable the vulnerable code (at the expense of reducing websocket performance).

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/tornadoweb/tornado/security/advisories/GHSA-cx3h-4qpv-8hc9
• https://github.com/tornadoweb/tornado/releases/tag/v6.5.6
• https://github.com/advisories/GHSA-cx3h-4qpv-8hc9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

CVE-2026-49853 / GHSA-3x9g-8vmp-wqvf

More information

Details

Summary

When SimpleAsyncHTTPClient follows a 3xx redirect, it shallow-copies the original HTTPRequest, rewrites the URL, decrements max_redirects, and removes only the Host header. It does not clear Authorization, auth_username, auth_password, or auth_mode when the redirect target changes origin.

As a result, credentials intended for one origin can be forwarded to a different origin when follow_redirects=True, which is the default.

Beginning in Tornado 6.5.6, SimpleAsyncHTTPClient matches the default behavior of libcurl (and therefore CurlAsyncHTTPClient): When a redirect changes the scheme, host, or port of the url, the Authorization and Cookie headers will be removed when following the redirect.

Severity

• CVSS Score: 7.7 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

• https://github.com/tornadoweb/tornado/security/advisories/GHSA-3x9g-8vmp-wqvf
• https://github.com/advisories/GHSA-3x9g-8vmp-wqvf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

CVE-2026-49855 / GHSA-mgf9-4vpg-hj56

More information

Details

Tornado's gzip decompression routines work in limited-size chunks, but have no overall limit for the total size of decompressed chunks that they will accumulate (There has always been a limit for the total compressed size). This allows a malicious server to consume effectively unlimited amounts of memory if it is accessed via SimpleAsyncHTTPClient in its default configuration. HTTPServer is not affected in its default configuration, but it is if decompress_request=True is set.

This bug is fixed in Tornado 6.5.6. max_body_size is now checked both for the compressed and cumulative decompressed size of the response.

Prior to upgrading, this issue can be mitigated by setting decompress_response=False or using CurlAsyncHTTPClient.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/tornadoweb/tornado/security/advisories/GHSA-mgf9-4vpg-hj56
• https://github.com/advisories/GHSA-mgf9-4vpg-hj56

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Tornado has out-of-bounds memory access via C extension

CVE-2026-49854 / GHSA-cx3h-4qpv-8hc9

More information

Details

Summary

Tornado's optional native extension tornado.speedups implements websocket_mask without validating that the mask argument is exactly four bytes long. The C function reads four bytes from mask unconditionally, even when Python passes a shorter byte string. This can read beyond the provided buffer, exposing up to 3 bytes of uninitialized memory.

The behavior is reachable from Tornado's XSRF token decoder when xsrf_cookies=True and the native extension is active.

Mitigations

This bug is fixed in Tornado 6.5.6. Prior to upgrading to this version, setting the environment variable TORNADO_EXTENSION=0 will disable the vulnerable code (at the expense of reducing websocket performance).

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/tornadoweb/tornado/security/advisories/GHSA-cx3h-4qpv-8hc9
• https://github.com/tornadoweb/tornado
• https://github.com/tornadoweb/tornado/releases/tag/v6.5.6

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

tornadoweb/tornado (tornado)

v6.5.6

Compare Source

---

Configuration

📅 Schedule: (in timezone America/Montreal)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.