Three Tornado Security Vulnerabilities Patched in Version 6.5.6

Tornado maintainers have released version 6.5.6 to patch three security issues in the Python web framework, including CVE-2026-49853, CVE-2026-49855, and CVE-2026-49854. CVE-2026-49853 (7.7) can leak Authorization headers when SimpleAsyncHTTPClient follows redirects to a different origin, potentially exposing credentials across sites. CVE-2026-49855 (7.5) addresses a gzip bomb that could exhaust memory, while CVE-2026-49854 (5.3) fixes an out-of-bounds read in Tornado’s optional native extension that could reveal small amounts of uninitialized memory. Upgrading to Tornado 6.5.6 is the recommended mitigation, especially to address the credential-leak risk.