CVE-2026-116578

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-601"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116578.json"
}

References

Affected packages

Git / github.com/tornadoweb/tornado

Affected ranges

Type

GIT

Repo

https://github.com/tornadoweb/tornado

Events

Introduced

Fixed

e2b0f452bbf0e554c64e9d9ee922341c1c634d95

Fixed

940ea725bdd9bc68231d68a105eef17ea6e11233

Fixed

cc75ab0eb3af459c714895a49f682ad354f50117

Fixed

ccb6a2e5482f17997efd4a74b8200d5b4babc035

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "6.6"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "940ea725bdd9bc68231d68a105eef17ea6e11233"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "cc75ab0eb3af459c714895a49f682ad354f50117"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "ccb6a2e5482f17997efd4a74b8200d5b4babc035"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v6.6.0",
            "range": [
                {
                    "fixed": "e2b0f452bbf0e554c64e9d9ee922341c1c634d95"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v1.*

v1.0.0

v1.1.0

v1.2.0

v2.*

v2.0.0

v2.1.0

v2.1.1

v2.2.0

v2.3.0

v3.*

v3.0.0

v3.0.1

v3.1.0

v3.2.0

v3.2.0b1

v3.2.0b2

v4.*

v4.0.0

v4.0.0b1

v4.0.0b2

v4.0.0b3

v4.1.0

v4.1.0b1

v4.1.0b2

v4.2.0

v4.2.0b1

v4.3.0

v4.3.0b1

v4.3.0b2

v4.4.0

v4.4.0b1

v4.4.1

v4.5.0

v4.5.1

v5.*

v5.0.0

v5.1.0

v6.*

v6.0.0

v6.0.0b1

v6.1.0

v6.1.0b1

v6.1.0b2

v6.2.0

v6.2.0b1

v6.2.0b2

v6.3.0

v6.3.0b1

v6.3.1

v6.4.0

v6.4.0b1

v6.4.1

v6.5.0

v6.5.0b1

v6.6.0a1

v6.6.0b1

v6.6.0rc1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-116578.json"