This update for python-tornado fixes the following issues:
- CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of
Content-Length headers accepting non-standard characters. At (bsc#1280689).
- CVE-2024-58384: CRLF injection in CurlAsyncHTTPClient headers (bsc#1281059).
- CVE-2026-91990: splitting of multipart data before validation of the `max_parts` limit allows for resource exhaustion
and a denial of service (bsc#1281439).
- CVE-2026-91991: incomplete fix for cookie attribute injection allows for cookie validation bypass via semicolon-
delimited data in capitalized parameters
This update for python-tornado fixes the following issue:
- CVE-2026-82397: an unauthenticated request body containing millions of separator-delimited fields can synchronously
stall the single-threaded event loop and delay every connection (bsc#1277725).
This update for python-tornado fixes the following issues
- CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395).
- CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396).
- CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).
This update for python-tornado fixes the following issues:
- CVE-2026-31958: parsing large multipart bodies with many parts can cause a denial of service (bsc#1259553).
- incomplete validation of cookie attributes allows for injection of user-controlled values in other cookie attributes
(bsc#1259630).
This update for python-tornado fixes the following issues:
- CVE-2025-67725: inefficient algorithm when parsing parameters for HTTP header values (bsc#1254905).
- CVE-2025-67726: Denial of Service (DoS) via maliciously crafted HTTP request caused by the HTTPHeaders.add method (bsc#1254904).