PyPI/tornado CVE-2026-49853: high 7.7, EPSS 0.45%

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

Action: Upgrade tornado to 6.5.6 or later.

pip install tornado==6.5.6

Affected

Fixed versions

Sources

• osv: GHSA-3x9g-8vmp-wqvf
• https://github.com/tornadoweb/tornado/security/advisories/GHSA-3x9g-8vmp-wqvf
• https://github.com/tornadoweb/tornado

CVE-2026-49853 · published 2026-06-15T20:20:00Z · modified 2026-09-10T03:50:55.306087854Z · JSON