RHSA-2026:90777HighCVSS 7.7

Red Hat Security Advisory: python-tornado security update

Published
October 27, 2026
Last Modified
November 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-49853 →

📋 Description

CVE-2026-49853 — tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects

🎯 Affected products14

  • Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • python-tornado-0:6.4.2-1.el9_4.3.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • python-tornado-debugsource-0:6.4.2-1.el9_4.3.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • python-tornado-debugsource-0:6.4.2-1.el9_4.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • python-tornado-debugsource-0:6.4.2-1.el9_4.3.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • python-tornado-debugsource-0:6.4.2-1.el9_4.3.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • python3-tornado-0:6.4.2-1.el9_4.3.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • python3-tornado-0:6.4.2-1.el9_4.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • python3-tornado-0:6.4.2-1.el9_4.3.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • python3-tornado-0:6.4.2-1.el9_4.3.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • python3-tornado-debuginfo-0:6.4.2-1.el9_4.3.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • python3-tornado-debuginfo-0:6.4.2-1.el9_4.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • python3-tornado-debuginfo-0:6.4.2-1.el9_4.3.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • python3-tornado-debuginfo-0:6.4.2-1.el9_4.3.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Applications utilizing Tornado's SimpleAsyncHTTPClient can mitigate this issue by explicitly disabling automatic redirection following. This can be achieved by setting `follow_redirects=False` when making HTTP requests. Manually handling redirects allows applications to ensure sensitive headers are not inadvertently sent to unintended origins. Disabling automatic redirects may alter application behavior that relies on this feature.

🔗 References (4)