CVE-2026-49854: Tornado Framework Buffer Overflow Flaw

CVE-2026-49854 Overview

CVE-2026-49854 is an out-of-bounds read vulnerability [CWE-126] in the Tornado Python web framework. The flaw exists in the optional tornado.speedups native C extension, specifically within the websocket_mask function. Prior to version 6.5.6, the function accepted a mask argument without verifying it was exactly four bytes. When reached through Tornado's XSRF token decoding path with the native extension active, the C code can read up to three bytes beyond the provided buffer. This may leak adjacent process memory contents to callers that can influence the mask input.

Critical Impact
Remote unauthenticated attackers can trigger a bounded out-of-bounds read through XSRF token decoding, potentially exposing small amounts of adjacent process memory in Tornado applications running the native speedups extension.

Affected Products

Tornado web framework versions prior to 6.5.6
Deployments with the optional tornado.speedups C extension installed and loaded
Applications using Tornado XSRF token decoding paths

Discovery Timeline

2026-07-14 - CVE-2026-49854 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-49854

Vulnerability Analysis

The defect resides in the websocket_mask function of tornado/speedups.c. The C implementation parses two byte-string arguments using PyArg_ParseTuple with the s#s# format specifier. It then casts the first four bytes of the mask buffer to a uint32_t without confirming that the caller supplied exactly four bytes. When the mask is shorter than four bytes, the cast reads memory adjacent to the Python buffer. The read extends up to three bytes past the allocation.

Tornado's XSRF token decoding path reaches this function during request processing. An attacker who can influence the decoded mask length can therefore trigger the out-of-bounds read remotely without authentication. The impact is limited to a small, bounded read of process memory adjacent to the input buffer.

Root Cause

The root cause is missing input validation on the mask_len parameter before dereferencing mask as a 32-bit integer. The original code assumed callers would always supply a four-byte mask, an invariant that XSRF token decoding did not enforce.

Attack Vector

Exploitation requires network access to an HTTP endpoint that invokes Tornado XSRF token verification while the speedups extension is loaded. No authentication or user interaction is needed. The attacker submits a crafted XSRF token that decodes to a mask shorter than four bytes.

// Security patch in tornado/speedups.c - validate mask length
// Source: https://github.com/tornadoweb/tornado/commit/96dc88c2a05705287856b2cd6b4b4034f9a6aaac
static PyObject *websocket_mask(PyObject *self, PyObject *args)
{
    const char *mask;
    Py_ssize_t mask_len;
    uint32_t uint32_mask;
    uint64_t uint64_mask;
    const char *data;
    Py_ssize_t data_len;
    Py_ssize_t i;
    PyObject *result;
    char *buf;

    if (!PyArg_ParseTuple(args, "s#s#", &mask, &mask_len, &data, &data_len))
    {
        return NULL;
    }

    if (mask_len != 4)
    {
        PyErr_SetString(PyExc_ValueError, "mask must be 4 bytes");
        return NULL;
    }

    uint32_mask = ((uint32_t*)mask)[0];

The patch adds an explicit length check that raises ValueError if mask_len is not exactly four bytes, preventing the out-of-bounds read.

Detection Methods for CVE-2026-49854

Indicators of Compromise

Unexpected ValueError: mask must be 4 bytes exceptions in application logs after upgrading to 6.5.6, indicating prior probe attempts
Repeated malformed XSRF token submissions from the same source IP
Anomalous HTTP request patterns targeting endpoints protected by Tornado XSRF verification

Detection Strategies

Inventory Python environments to identify Tornado installations older than 6.5.6 with the compiled speedups extension present
Monitor web application logs for a spike in XSRF token validation failures or decoding errors
Instrument Tornado applications to log the length of decoded XSRF token components during a triage window

Monitoring Recommendations

Enable verbose logging on XSRF token verification paths to capture suspicious inputs
Alert on repeated 4xx responses tied to XSRF failures from a single origin
Track the presence of tornado/speedups*.so binaries across deployed containers and hosts

How to Mitigate CVE-2026-49854

Immediate Actions Required

Upgrade Tornado to version 6.5.6 or later across all Python environments
Rebuild and redeploy container images that pin an earlier Tornado release
Audit dependent frameworks and applications that bundle Tornado transitively

Patch Information

The fix is included in Tornado 6.5.6 and is tracked in GitHub Security Advisory GHSA-cx3h-4qpv-8hc9. The code change is available in the GitHub commit and discussed in the pull request. Release notes are published under Tornado v6.5.6.

Workarounds

If upgrading immediately is not feasible, uninstall or disable the compiled tornado.speedups extension so the pure-Python websocket_mask implementation is used
Remove or rename tornado/speedups*.so from the deployment to force the Python fallback
Restrict network exposure of Tornado endpoints behind a reverse proxy that validates request structure

bash

# Upgrade Tornado to the patched release
pip install --upgrade "tornado>=6.5.6"

# Verify the installed version
python -c "import tornado; print(tornado.version)"

# Optional: remove the native speedups extension as a temporary mitigation
find "$(python -c 'import tornado, os; print(os.path.dirname(tornado.__file__))')" \
    -name 'speedups*.so' -delete