OESA-2026-1903

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-1903

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-1903.json

JSON Data

https://api.test.osv.dev/v1/vulns/OESA-2026-1903

Upstream

CVE-2025-67724

CVE-2026-35536

Published

2026-04-11T14:05:38Z

Modified

2026-04-11T14:18:54.409959Z

Summary

python-tornado security update

Details

Tornado is an open source version of the scalable, non-blocking web server and tools.

Security Fix(es):

Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom "reason" phrases (the "Not Found" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). This issue is fixed in version 6.5.3.(CVE-2025-67724)

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.(CVE-2026-35536)

Database specific

{
    "severity": "High"
}

References

Affected packages

openEuler:20.03-LTS-SP4

python-tornado

Package

Name: python-tornado
Purl: pkg:rpm/openEuler/python-tornado&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.0.2-12.oe2003sp4

Ecosystem specific

{
    "src": [
        "python-tornado-5.0.2-12.oe2003sp4.src.rpm"
    ],
    "x86_64": [
        "python-tornado-debuginfo-5.0.2-12.oe2003sp4.x86_64.rpm",
        "python-tornado-debugsource-5.0.2-12.oe2003sp4.x86_64.rpm",
        "python2-tornado-5.0.2-12.oe2003sp4.x86_64.rpm",
        "python3-tornado-5.0.2-12.oe2003sp4.x86_64.rpm"
    ],
    "aarch64": [
        "python-tornado-debuginfo-5.0.2-12.oe2003sp4.aarch64.rpm",
        "python-tornado-debugsource-5.0.2-12.oe2003sp4.aarch64.rpm",
        "python2-tornado-5.0.2-12.oe2003sp4.aarch64.rpm",
        "python3-tornado-5.0.2-12.oe2003sp4.aarch64.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-1903.json"

openEuler:22.03-LTS-SP4

python-tornado

Package

Name: python-tornado
Purl: pkg:rpm/openEuler/python-tornado&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.1-7.oe2203sp4

Ecosystem specific

{
    "src": [
        "python-tornado-6.1-7.oe2203sp4.src.rpm"
    ],
    "x86_64": [
        "python-tornado-debuginfo-6.1-7.oe2203sp4.x86_64.rpm",
        "python-tornado-debugsource-6.1-7.oe2203sp4.x86_64.rpm",
        "python-tornado-help-6.1-7.oe2203sp4.x86_64.rpm",
        "python3-tornado-6.1-7.oe2203sp4.x86_64.rpm"
    ],
    "aarch64": [
        "python-tornado-debuginfo-6.1-7.oe2203sp4.aarch64.rpm",
        "python-tornado-debugsource-6.1-7.oe2203sp4.aarch64.rpm",
        "python-tornado-help-6.1-7.oe2203sp4.aarch64.rpm",
        "python3-tornado-6.1-7.oe2203sp4.aarch64.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-1903.json"

openEuler:24.03-LTS

python-tornado

Package

Name: python-tornado
Purl: pkg:rpm/openEuler/python-tornado&distro=openEuler-24.03-LTS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.5-4.oe2403sp2

Ecosystem specific

{
    "src": [
        "python-tornado-6.5-4.oe2403sp3.src.rpm",
        "python-tornado-6.5-4.oe2403.src.rpm",
        "python-tornado-6.5-4.oe2403sp1.src.rpm",
        "python-tornado-6.5-4.oe2403sp2.src.rpm"
    ],
    "x86_64": [
        "python-tornado-debuginfo-6.5-4.oe2403sp3.x86_64.rpm",
        "python-tornado-debugsource-6.5-4.oe2403sp3.x86_64.rpm",
        "python-tornado-help-6.5-4.oe2403sp3.x86_64.rpm",
        "python3-tornado-6.5-4.oe2403sp3.x86_64.rpm",
        "python-tornado-debuginfo-6.5-4.oe2403.x86_64.rpm",
        "python-tornado-debugsource-6.5-4.oe2403.x86_64.rpm",
        "python-tornado-help-6.5-4.oe2403.x86_64.rpm",
        "python3-tornado-6.5-4.oe2403.x86_64.rpm",
        "python-tornado-debuginfo-6.5-4.oe2403sp1.x86_64.rpm",
        "python-tornado-debugsource-6.5-4.oe2403sp1.x86_64.rpm",
        "python-tornado-help-6.5-4.oe2403sp1.x86_64.rpm",
        "python3-tornado-6.5-4.oe2403sp1.x86_64.rpm",
        "python-tornado-debuginfo-6.5-4.oe2403sp2.x86_64.rpm",
        "python-tornado-debugsource-6.5-4.oe2403sp2.x86_64.rpm",
        "python-tornado-help-6.5-4.oe2403sp2.x86_64.rpm",
        "python3-tornado-6.5-4.oe2403sp2.x86_64.rpm"
    ],
    "aarch64": [
        "python-tornado-debuginfo-6.5-4.oe2403sp3.aarch64.rpm",
        "python-tornado-debugsource-6.5-4.oe2403sp3.aarch64.rpm",
        "python-tornado-help-6.5-4.oe2403sp3.aarch64.rpm",
        "python3-tornado-6.5-4.oe2403sp3.aarch64.rpm",
        "python-tornado-debuginfo-6.5-4.oe2403.aarch64.rpm",
        "python-tornado-debugsource-6.5-4.oe2403.aarch64.rpm",
        "python-tornado-help-6.5-4.oe2403.aarch64.rpm",
        "python3-tornado-6.5-4.oe2403.aarch64.rpm",
        "python-tornado-debuginfo-6.5-4.oe2403sp1.aarch64.rpm",
        "python-tornado-debugsource-6.5-4.oe2403sp1.aarch64.rpm",
        "python-tornado-help-6.5-4.oe2403sp1.aarch64.rpm",
        "python3-tornado-6.5-4.oe2403sp1.aarch64.rpm",
        "python-tornado-debuginfo-6.5-4.oe2403sp2.aarch64.rpm",
        "python-tornado-debugsource-6.5-4.oe2403sp2.aarch64.rpm",
        "python-tornado-help-6.5-4.oe2403sp2.aarch64.rpm",
        "python3-tornado-6.5-4.oe2403sp2.aarch64.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-1903.json"

openEuler:24.03-LTS-SP1

python-tornado

Package

Name: python-tornado
Purl: pkg:rpm/openEuler/python-tornado&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.5-4.oe2403sp1

Ecosystem specific

{
    "src": [
        "python-tornado-6.5-4.oe2403sp1.src.rpm"
    ],
    "x86_64": [
        "python-tornado-debuginfo-6.5-4.oe2403sp1.x86_64.rpm",
        "python-tornado-debugsource-6.5-4.oe2403sp1.x86_64.rpm",
        "python-tornado-help-6.5-4.oe2403sp1.x86_64.rpm",
        "python3-tornado-6.5-4.oe2403sp1.x86_64.rpm"
    ],
    "aarch64": [
        "python-tornado-debuginfo-6.5-4.oe2403sp1.aarch64.rpm",
        "python-tornado-debugsource-6.5-4.oe2403sp1.aarch64.rpm",
        "python-tornado-help-6.5-4.oe2403sp1.aarch64.rpm",
        "python3-tornado-6.5-4.oe2403sp1.aarch64.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-1903.json"

openEuler:24.03-LTS-SP2

python-tornado

Package

Name: python-tornado
Purl: pkg:rpm/openEuler/python-tornado&distro=openEuler-24.03-LTS-SP2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.5-4.oe2403sp2

Ecosystem specific

{
    "src": [
        "python-tornado-6.5-4.oe2403sp2.src.rpm"
    ],
    "x86_64": [
        "python-tornado-debuginfo-6.5-4.oe2403sp2.x86_64.rpm",
        "python-tornado-debugsource-6.5-4.oe2403sp2.x86_64.rpm",
        "python-tornado-help-6.5-4.oe2403sp2.x86_64.rpm",
        "python3-tornado-6.5-4.oe2403sp2.x86_64.rpm"
    ],
    "aarch64": [
        "python-tornado-debuginfo-6.5-4.oe2403sp2.aarch64.rpm",
        "python-tornado-debugsource-6.5-4.oe2403sp2.aarch64.rpm",
        "python-tornado-help-6.5-4.oe2403sp2.aarch64.rpm",
        "python3-tornado-6.5-4.oe2403sp2.aarch64.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-1903.json"

openEuler:24.03-LTS-SP3

python-tornado

Package

Name: python-tornado
Purl: pkg:rpm/openEuler/python-tornado&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.5-4.oe2403sp3

Ecosystem specific

{
    "src": [
        "python-tornado-6.5-4.oe2403sp3.src.rpm"
    ],
    "x86_64": [
        "python-tornado-debuginfo-6.5-4.oe2403sp3.x86_64.rpm",
        "python-tornado-debugsource-6.5-4.oe2403sp3.x86_64.rpm",
        "python-tornado-help-6.5-4.oe2403sp3.x86_64.rpm",
        "python3-tornado-6.5-4.oe2403sp3.x86_64.rpm"
    ],
    "aarch64": [
        "python-tornado-debuginfo-6.5-4.oe2403sp3.aarch64.rpm",
        "python-tornado-debugsource-6.5-4.oe2403sp3.aarch64.rpm",
        "python-tornado-help-6.5-4.oe2403sp3.aarch64.rpm",
        "python3-tornado-6.5-4.oe2403sp3.aarch64.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-1903.json"