CVE-2026-49854

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.5.6

Description The optional native extension tornado.speedups implements the websocket mask function without validating that the mask argument is exactly four bytes long. The C function reads four bytes from mask unconditionally, which can lead to reading beyond the provided buffer and exposing up to 3 bytes of uninitialized memory. This behavior is reachable via the XSRF token decoder when xsrf cookies=True and the native extension is active.

Recommendations Update to version 6.5.6 or later. As a temporary workaround, set the environment variable TORNADO EXTENSION=0 to disable the vulnerable native extension.