CVE-2026-49853

Published: Jul 14, 2026Modified: Jul 21, 2026Deferred

7.7

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Exploitability: 3.1 / Impact: 4.0

Source: security-advisories@github.com (Secondary)

Description

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751

Source: security-advisories@github.com

https://github.com/tornadoweb/tornado/pull/3626

Source: security-advisories@github.com

https://github.com/tornadoweb/tornado/releases/tag/v6.5.6

Source: security-advisories@github.com

https://github.com/tornadoweb/tornado/security/advisories/GHSA-3x9g-8vmp-wqvf

Source: security-advisories@github.com

Timeline

No history available yet.