Vulnerability · CVE-2026-116578
Tornado is a Python web framework and asynchronous networking library.
Published Oct 26, 2026 · catalog updated Oct 28, 2026 · Red Hat Red Hat Enterprise Linux
Last checked Nov 5, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-116578. EPSS is 0.46%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.
Gaps on this record
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
Same product and reporting
- CVE-2026-99280 · Medium
- CVE-2026-99279 · Medium
- CVE-2026-99282 · Medium
- CVE-2026-99281 · High
- CVE-2026-99278 · Medium
- Severity
- Medium6.1
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.46%
- Remediation
- Version ranges on file
- Affected products
- Debian:12 python-tornado · Debian:13 python-tornado · Debian:14 python-tornado · PyPI tornado · pip tornado · pypi tornado
### Summary builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the application's domain, which can be used in phishing. ### Impact Applications are affected if they use with a URL template where a regex capture group can influence the scheme or host of the redirect. This includes: - **A substitution at the start of the path**, for example . A request to redirects to , a protocol-relative URL pointing to evil.com. Variants using backslashes or encoded characters have the same effect, because browsers treat them as equivalent to . - **A substitution directly after the host**, for example . A request to or redirects to evil.com. - **A template that begins with a substitution** (such as ), which can be given an absolute URL. Applications are not affected if their templates use only static URLs, or if every substitution comes after a fixed host and a (for example or ). Other uses of are not affected by this advisory, although applications that pass user-controlled input to should validate it themselves. ### Patches Fixed in Tornado 6.6. now returns a 400 error if the substituted values would change the scheme or host of the redirect from what the template specifies. As a result, substitutions can no longer be used in the scheme or host part of a template. The similar check in has also been hardened against backslash and whitespace variants. ### Workarounds - Change templates so every substitution comes after a fixed prefix ending in , or write capture-group regexes that cannot match characters such as , , , or where they could affect the host. - Alternatively, replace with a custom handler that validates the target before calling . ### Credit Reported by Longwei Wang (@gn00295120).
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- Debian:12 python-tornado6.2.0-3, 6.2.0-3+deb12u1, 6.2.0-3+deb12u2
- Debian:13 python-tornado6.4.2-3, 6.4.2-3+deb13u1, 6.4.2-3+deb13u2
- Debian:14 python-tornado6.4.2-3, 6.5.2-1, 6.5.2-2
- PyPI tornado0 → 6.6
- pip tornado< 6.6
- pypi tornadoversion unspecified
How to fix CVE-2026-116578
Upgrade
CVE-2026-116578 lists a fix boundary at 6.6. Compare the installed build with that boundary before you change production.
Version check
Affected < 6.6
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-116578. EPSS is 0.46%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.
Which versions are affected?
Compare what you have installed with 6.2.0-3, 6.2.0-3+deb12u1, 6.2.0-3+deb12u2, 6.4.2-3, 6.4.2-3+deb13u1, 6.4.2-3+deb13u2, 6.4.2-3, 6.5.2-1, 6.5.2-2, 0 → 6.6, < 6.6. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-601: URL Redirection to Untrusted Site (Open Redirect). EPSS 0.46%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Technology hubs
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 26, 2026 · Red Hat Security Data
Detected
tornado: tornado: Open redirect via crafted request paths in RedirectHandler URL templates
Oct 27, 2026 · Trivy Vulnerability DB
Updated
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative
Oct 28, 2026 · GitHub Advisory Database
Fix available
tornado fixed in 6.6
Oct 28, 2026 · GitHub Advisory Database
Fix available
tornado fixed in 6.6
Oct 28, 2026 · GitHub Advisory Database
Updated
### Summary builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the application's domain, which can be used in phishing. ### Impact Applications are affected if they use with a URL template where a r
Sources
- CVE.orgVulnerability recordCVE-2026-116578
Official CVE identifier
cve.org - GitHub Advisory DatabasePackage advisoryGHSA-pw9p-v7r6-gx4p
Tornado: Open redirect in RedirectHandler via protocol-relative URLs
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-116578
tornado.web.RedirectHandler builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the application's domain, which can be used in phishing.
advisories.gitlab.com - OpenSSF OSV / OSV ScannerPackage advisoryGHSA-pw9p-v7r6-gx4p
Tornado: Open redirect in RedirectHandler via protocol-relative URLs
osv.dev - Red Hat Security DataVendor advisoryCVE-2026-116578
tornado: tornado: Open redirect via crafted request paths in RedirectHandler URL templates
access.redhat.com - Trivy Vulnerability DBPackage advisoryDEBIAN-CVE-2026-116578
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutio
osv.dev
References
Freshness
Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- GitHub Advisory DatabaseOct 30, 2026
- GitLab Advisory DatabaseOct 29, 2026
- OpenSSF OSV / OSV ScannerOct 29, 2026
- CVE.orgOct 27, 2026
- Trivy Vulnerability DBOct 27, 2026
- Red Hat Security DataOct 27, 2026