tornadoweb Tornado up to 6.6.0 URL Parser tornado.web tornado.web.RedirectHandler redirect

Summaryinfo

A vulnerability categorized as problematic has been discovered in tornadoweb Tornado up to 6.6.0. Affected is the function tornado.web.RedirectHandler of the file tornado.web of the component URL Parser. Such manipulation leads to redirect. This vulnerability is documented as CVE-2026-126347. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in tornadoweb Tornado up to 6.6.0. Affected by this issue is the function tornado.web.RedirectHandler of the file tornado.web of the component URL Parser. The manipulation with an unknown input leads to a redirect vulnerability. Using CWE to declare the problem leads to CWE-601. The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. Impacted is integrity. CVE summarizes:

Tornado is a Python web framework and asynchronous networking library. In versions through 6.6.0, applications using  tornado.web.RedirectHandler  with URL templates that allow attacker-controlled substitutions to influence the destination can be vulnerable to an open redirect using three or more leading slashes. Differences between Python’s URL parsing and browser URL interpretation allow a crafted destination to redirect a user to an attacker-controlled host. The remediation for CVE-2026-116578 in version 6.6.0 did not fully address this case. This issue is fixed in version 6.6.1.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-126347 since 11/10/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1204.001.

Upgrading to version 6.6.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• tornadoweb

Name

• Tornado

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6.0

Website

• Product: https://github.com/tornadoweb/tornado/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion