Tornado's optional native extension tornado.speedups implements websocket mask without validating that the mask argument is exactly four bytes long. The C function reads four bytes from mask unconditionally, even when Python passes a shorter byte string. This can read beyond the provided buffer, exposing up to 3 bytes of uninitialized memory.

The behavior is reachable from Tornado's XSRF token decoder when xsrf cookies=True and the native extension is active.

This bug is fixed in Tornado 6.5.6. Prior to upgrading to this version, setting the environment variable TORNADO EXTENSION=0 will disable the vulnerable code (at the expense of reducing websocket performance).