3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-49854

CVE-2026-49854: Tornado has out-of-bounds memory access via C extension

Summary

Tornado's optional native extension tornado.speedups implements websocket_mask without validating that the mask argument is exactly four bytes long. The C function reads four bytes from mask unconditionally, even when Python passes a shorter byte string. This can read beyond the provided buffer, exposing up to 3 bytes of uninitialized memory.

The behavior is reachable from Tornado's XSRF token decoder when xsrf_cookies=True and the native extension is active.

Mitigations

This bug is fixed in Tornado 6.5.6. Prior to upgrading to this version, setting the environment variable TORNADO_EXTENSION=0 will disable the vulnerable code (at the expense of reducing websocket performance).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-49854

CVE-2026-49854:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
tornado	pip	< 6.5.6	6.5.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a buffer over-read in the websocket_mask function located in Tornado's C extension, tornado.speedups. This function is used for unmasking websocket frames but is also leveraged by the XSRF token decoding mechanism.

The root cause is that the C implementation of websocket_mask unconditionally reads 4 bytes from the mask parameter, without first verifying that the provided buffer is at least 4 bytes long.

An attacker can trigger this by providing a crafted _xsrf cookie. When the application calls check_xsrf_cookie() (or any method that triggers it, like decode_signed_value with xsrf_cookies=True), the _decode_xsrf_token method is called. This method base64-decodes the cookie and uses the first 4 bytes as the mask for the websocket_mask function. If the decoded cookie value is less than 4 bytes, the call to websocket_mask results in reading beyond the buffer's boundary, exposing adjacent memory contents.

The patch mitigates this by adding a length check at the beginning of both the C function websocket_mask in tornado/speedups.c and its Python fallback _websocket_mask_python in tornado/util.py, ensuring the mask is exactly 4 bytes long.

Therefore, the key function to monitor is speedups.websocket_mask, as it's the one containing the memory corruption vulnerability. The Python fallback _websocket_mask_python is also relevant as it was patched defensively.

Vulnerable functions

speedups.websocket_mask

tornado/speedups.c

The C function `websocket_mask` reads 4 bytes from the `mask` argument without validating its length. If a string shorter than 4 bytes is passed, it leads to a buffer over-read, reading uninitialized memory. The patch adds a length check to prevent this.

_websocket_mask_python

tornado/util.py

This is the pure-Python implementation of the websocket masking function. While the primary vulnerability is in the C extension, this function was also patched to include the same length validation, preventing potential issues if the C extension is disabled. It processes the `mask` and `data` from the XSRF token.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.