An update for python-tornado is now available for openEuler-24.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4034 Final 1.0 1.0 2026-09-25 Initial 2026-09-25 2026-09-25 openEuler SA Tool V1.0 2026-09-25 python-tornado security update An update for python-tornado is now available for openEuler-24.03-LTS-SP1 Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived connection to each user. Security Fix(es): Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.(CVE-2023-54397) Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.(CVE-2024-14029) Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.(CVE-2024-58384) Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.(CVE-2026-91990) Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.(CVE-2026-91991) Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.(CVE-2026-91992) An update for python-tornado is now available for openEuler-20.03-LTS-SP4/openEuler-24.03-LTS-SP1. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High python-tornado https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4034 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-54397 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-14029 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-58384 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-91990 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-91991 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-91992 https://nvd.nist.gov/vuln/detail/CVE-2023-54397 https://nvd.nist.gov/vuln/detail/CVE-2024-14029 https://nvd.nist.gov/vuln/detail/CVE-2024-58384 https://nvd.nist.gov/vuln/detail/CVE-2026-91990 https://nvd.nist.gov/vuln/detail/CVE-2026-91991 https://nvd.nist.gov/vuln/detail/CVE-2026-91992 openEuler-24.03-LTS-SP1 python-tornado-6.5.10-1.oe2403sp1.src.rpm python-tornado-debuginfo-6.5.10-1.oe2403sp1.aarch64.rpm python-tornado-debugsource-6.5.10-1.oe2403sp1.aarch64.rpm python3-tornado-6.5.10-1.oe2403sp1.aarch64.rpm python-tornado-debuginfo-6.5.10-1.oe2403sp1.x86_64.rpm python-tornado-debugsource-6.5.10-1.oe2403sp1.x86_64.rpm python3-tornado-6.5.10-1.oe2403sp1.x86_64.rpm python-tornado-help-6.5.10-1.oe2403sp1.noarch.rpm Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies. 2026-09-25 CVE-2023-54397 openEuler-24.03-LTS-SP1 High 7.5 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N python-tornado security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4034 Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization. 2026-09-25 CVE-2024-14029 openEuler-24.03-LTS-SP1 High 7.5 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N python-tornado security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4034 Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests. 2026-09-25 CVE-2024-58384 openEuler-24.03-LTS-SP1 Medium 5.4 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N python-tornado security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4034 Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service. 2026-09-25 CVE-2026-91990 openEuler-24.03-LTS-SP1 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-tornado security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4034 Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes. 2026-09-25 CVE-2026-91991 openEuler-24.03-LTS-SP1 Medium 5.4 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N python-tornado security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4034 Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests. 2026-09-25 CVE-2026-91992 openEuler-24.03-LTS-SP1 Medium 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N python-tornado security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4034