PkgSeer

Vulnerability GHSA-5cjw-f85j-cv6r

Low Risk
LOW RISK
CVSS Score: 3.1
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
4 hours ago
November 13, 2026 at 08:31 PM UTC
Tornado: Open redirect via triple-slash redirect paths
0.2 and 1.0 and 1.1 and 1.1.1 and 1.2 and 1.2.1 and 2.0 and 2.1 and 2.1.1 and 2.2 and 2.2.1 and 2.3 and 2.4 and 2.4.1 and 3.0 and 3.0.1 - 3.0.2 and 3.1 and 3.1.1 and 3.2 and 3.2.1 - 3.2.2 and 4.0 and 4.0.1 - 4.0.2 and 4.1b2 and 4.1 and 4.2b1 and 4.2 and 4.2.1 and 4.3b1 and 4.3b2 and 4.3 and 4.4b1 and 4.4 and 4.4.1 - 4.4.3 and 4.5b1 and 4.5b2 and 4.5 and 4.5.1 - 4.5.3 and 5.0a1 and 5.0b1 and 5.0 and 5.0.1 - 5.0.2 and 5.1b1 and 5.1 and 5.1.1 and 6.0a1 and 6.0b1 and 6.0 and 6.0.1 - 6.0.4 and 6.1b1 and 6.1b2 and 6.1 and 6.2b1 and 6.2b2 and 6.2 and 6.3b1 and 6.3 and 6.3.1 - 6.3.3 and 6.4b1 and 6.4 and 6.4.1 - 6.4.2 and 6.5b1 and 6.5 and 6.5.1 - 6.5.10 and 6.6a1 and 6.6b1 and 6.6rc1 and 6.6
0.2 and 1.0 and 1.1 and 1.1.1 and 1.2 and 1.2.1 and 2.0 and 2.1 and 2.1.1 and 2.2 and 2.2.1 and 2.3 and 2.4 and 2.4.1 and 3.0 and 3.0.1 - 3.0.2 and 3.1 and 3.1.1 and 3.2 and 3.2.1 - 3.2.2 and 4.0 and 4.0.1 - 4.0.2 and 4.1b2 and 4.1 and 4.2b1 and 4.2 and 4.2.1 and 4.3b1 and 4.3b2 and 4.3 and 4.4b1 and 4.4 and 4.4.1 - 4.4.3 and 4.5b1 and 4.5b2 and 4.5 and 4.5.1 - 4.5.3 and 5.0a1 and 5.0b1 and 5.0 and 5.0.1 - 5.0.2 and 5.1b1 and 5.1 and 5.1.1 and 6.0a1 and 6.0b1 and 6.0 and 6.0.1 - 6.0.4 and 6.1b1 and 6.1b2 and 6.1 and 6.2b1 and 6.2b2 and 6.2 and 6.3b1 and 6.3 and 6.3.1 - 6.3.3 and 6.4b1 and 6.4 and 6.4.1 - 6.4.2 and 6.5b1 and 6.5 and 6.5.1 - 6.5.10 and 6.6a1 and 6.6b1 and 6.6rc1 and 6.6

Summary

Tornado: Open redirect via triple-slash redirect paths

Details

Summary

Due to differences in the way browsers and Python's urllib parse urls, browsers treat a string starting with three or more slashes as a protocol-level redirect, while urllib does not. This means that the 6.6.0 fix for the RedirectHandler open redirect (CVE-2026-116578, commit cc75ab0e) is incomplete. Tornado 6.6.1 improves the open-redirect detection to handle this case correctly, as well as fixing a regression in the 6.6.0 implementation.

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Medium Risk
16 days ago
Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
0.2 and 1.0 and 1.1 and 1.1.1 and 1.2 and 1.2.1 and 2.0 and 2.1 and 2.1.1 and 2.2 and 2.2.1 and 2.3 and 2.4 and 2.4.1 and 3.0 and 3.0.1 - 3.0.2 and 3.1 and 3.1.1 and 3.2 and 3.2.1 - 3.2.2 and 4.0 and 4.0.1 - 4.0.2 and 4.1b2 and 4.1 and 4.2b1 and 4.2 and 4.2.1 and 4.3b1 and 4.3b2 and 4.3 and 4.4b1 and 4.4 and 4.4.1 - 4.4.3 and 4.5b1 and 4.5b2 and 4.5 and 4.5.1 - 4.5.3 and 5.0a1 and 5.0b1 and 5.0 and 5.0.1 - 5.0.2 and 5.1b1 and 5.1 and 5.1.1 and 6.0a1 and 6.0b1 and 6.0 and 6.0.1 - 6.0.4 and 6.1b1 and 6.1b2 and 6.1 and 6.2b1 and 6.2b2 and 6.2 and 6.3b1 and 6.3 and 6.3.1 - 6.3.3 and 6.4b1 and 6.4 and 6.4.1 - 6.4.2 and 6.5b1 and 6.5 and 6.5.1 - 6.5.10 and 6.6a1 and 6.6b1 and 6.6rc1 GHSA-r4j5-9xpp-3985
0.2 and 1.0 and 1.1 and 1.1.1 and 1.2 and 1.2.1 and 2.0 and 2.1 and 2.1.1 and 2.2 and 2.2.1 and 2.3 and 2.4 and 2.4.1 and 3.0 and 3.0.1 - 3.0.2 and 3.1 and 3.1.1 and 3.2 and 3.2.1 - 3.2.2 and 4.0 and 4.0.1 - 4.0.2 and 4.1b2 and 4.1 and 4.2b1 and 4.2 and 4.2.1 and 4.3b1 and 4.3b2 and 4.3 and 4.4b1 and 4.4 and 4.4.1 - 4.4.3 and 4.5b1 and 4.5b2 and 4.5 and 4.5.1 - 4.5.3 and 5.0a1 and 5.0b1 and 5.0 and 5.0.1 - 5.0.2 and 5.1b1 and 5.1 and 5.1.1 and 6.0a1 and 6.0b1 and 6.0 and 6.0.1 - 6.0.4 and 6.1b1 and 6.1b2 and 6.1 and 6.2b1 and 6.2b2 and 6.2 and 6.3b1 and 6.3 and 6.3.1 - 6.3.3 and 6.4b1 and 6.4 and 6.4.1 - 6.4.2 and 6.5b1 and 6.5 and 6.5.1 - 6.5.10 and 6.6a1 and 6.6b1 and 6.6rc1 GHSA-r4j5-9xpp-3985
Low Risk
16 days ago
Tornado: Open redirect in RedirectHandler via protocol-relative URLs
0.2 and 1.0 and 1.1 and 1.1.1 and 1.2 and 1.2.1 and 2.0 and 2.1 and 2.1.1 and 2.2 and 2.2.1 and 2.3 and 2.4 and 2.4.1 and 3.0 and 3.0.1 - 3.0.2 and 3.1 and 3.1.1 and 3.2 and 3.2.1 - 3.2.2 and 4.0 and 4.0.1 - 4.0.2 and 4.1b2 and 4.1 and 4.2b1 and 4.2 and 4.2.1 and 4.3b1 and 4.3b2 and 4.3 and 4.4b1 and 4.4 and 4.4.1 - 4.4.3 and 4.5b1 and 4.5b2 and 4.5 and 4.5.1 - 4.5.3 and 5.0a1 and 5.0b1 and 5.0 and 5.0.1 - 5.0.2 and 5.1b1 and 5.1 and 5.1.1 and 6.0a1 and 6.0b1 and 6.0 and 6.0.1 - 6.0.4 and 6.1b1 and 6.1b2 and 6.1 and 6.2b1 and 6.2b2 and 6.2 and 6.3b1 and 6.3 and 6.3.1 - 6.3.3 and 6.4b1 and 6.4 and 6.4.1 - 6.4.2 and 6.5b1 and 6.5 and 6.5.1 - 6.5.10 and 6.6a1 and 6.6b1 and 6.6rc1 GHSA-pw9p-v7r6-gx4p
0.2 and 1.0 and 1.1 and 1.1.1 and 1.2 and 1.2.1 and 2.0 and 2.1 and 2.1.1 and 2.2 and 2.2.1 and 2.3 and 2.4 and 2.4.1 and 3.0 and 3.0.1 - 3.0.2 and 3.1 and 3.1.1 and 3.2 and 3.2.1 - 3.2.2 and 4.0 and 4.0.1 - 4.0.2 and 4.1b2 and 4.1 and 4.2b1 and 4.2 and 4.2.1 and 4.3b1 and 4.3b2 and 4.3 and 4.4b1 and 4.4 and 4.4.1 - 4.4.3 and 4.5b1 and 4.5b2 and 4.5 and 4.5.1 - 4.5.3 and 5.0a1 and 5.0b1 and 5.0 and 5.0.1 - 5.0.2 and 5.1b1 and 5.1 and 5.1.1 and 6.0a1 and 6.0b1 and 6.0 and 6.0.1 - 6.0.4 and 6.1b1 and 6.1b2 and 6.1 and 6.2b1 and 6.2b2 and 6.2 and 6.3b1 and 6.3 and 6.3.1 - 6.3.3 and 6.4b1 and 6.4 and 6.4.1 - 6.4.2 and 6.5b1 and 6.5 and 6.5.1 - 6.5.10 and 6.6a1 and 6.6b1 and 6.6rc1 GHSA-pw9p-v7r6-gx4p
Medium Risk
16 days ago
Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
0.2 and 1.0 and 1.1 and 1.1.1 and 1.2 and 1.2.1 and 2.0 and 2.1 and 2.1.1 and 2.2 and 2.2.1 and 2.3 and 2.4 and 2.4.1 and 3.0 and 3.0.1 - 3.0.2 and 3.1 and 3.1.1 and 3.2 and 3.2.1 - 3.2.2 and 4.0 and 4.0.1 - 4.0.2 and 4.1b2 and 4.1 and 4.2b1 and 4.2 and 4.2.1 and 4.3b1 and 4.3b2 and 4.3 and 4.4b1 and 4.4 and 4.4.1 - 4.4.3 and 4.5b1 and 4.5b2 and 4.5 and 4.5.1 - 4.5.3 and 5.0a1 and 5.0b1 and 5.0 and 5.0.1 - 5.0.2 and 5.1b1 and 5.1 and 5.1.1 and 6.0a1 and 6.0b1 and 6.0 and 6.0.1 - 6.0.4 and 6.1b1 and 6.1b2 and 6.1 and 6.2b1 and 6.2b2 and 6.2 and 6.3b1 and 6.3 and 6.3.1 - 6.3.3 and 6.4b1 and 6.4 and 6.4.1 - 6.4.2 and 6.5b1 and 6.5 and 6.5.1 - 6.5.10 and 6.6a1 and 6.6b1 and 6.6rc1 GHSA-pcg2-g6cj-q92c
0.2 and 1.0 and 1.1 and 1.1.1 and 1.2 and 1.2.1 and 2.0 and 2.1 and 2.1.1 and 2.2 and 2.2.1 and 2.3 and 2.4 and 2.4.1 and 3.0 and 3.0.1 - 3.0.2 and 3.1 and 3.1.1 and 3.2 and 3.2.1 - 3.2.2 and 4.0 and 4.0.1 - 4.0.2 and 4.1b2 and 4.1 and 4.2b1 and 4.2 and 4.2.1 and 4.3b1 and 4.3b2 and 4.3 and 4.4b1 and 4.4 and 4.4.1 - 4.4.3 and 4.5b1 and 4.5b2 and 4.5 and 4.5.1 - 4.5.3 and 5.0a1 and 5.0b1 and 5.0 and 5.0.1 - 5.0.2 and 5.1b1 and 5.1 and 5.1.1 and 6.0a1 and 6.0b1 and 6.0 and 6.0.1 - 6.0.4 and 6.1b1 and 6.1b2 and 6.1 and 6.2b1 and 6.2b2 and 6.2 and 6.3b1 and 6.3 and 6.3.1 - 6.3.3 and 6.4b1 and 6.4 and 6.4.1 - 6.4.2 and 6.5b1 and 6.5 and 6.5.1 - 6.5.10 and 6.6a1 and 6.6b1 and 6.6rc1 GHSA-pcg2-g6cj-q92c
Medium Risk
1 month ago
Tornado: Unbounded query-string argument count allows event-loop-stalling DoS
0.2 and 1.0 and 1.1 and 1.1.1 and 1.2 and 1.2.1 and 2.0 and 2.1 and 2.1.1 and 2.2 and 2.2.1 and 2.3 and 2.4 and 2.4.1 and 3.0 and 3.0.1 - 3.0.2 and 3.1 and 3.1.1 and 3.2 and 3.2.1 - 3.2.2 and 4.0 and 4.0.1 - 4.0.2 and 4.1b2 and 4.1 and 4.2b1 and 4.2 and 4.2.1 and 4.3b1 and 4.3b2 and 4.3 and 4.4b1 and 4.4 and 4.4.1 - 4.4.3 and 4.5b1 and 4.5b2 and 4.5 and 4.5.1 - 4.5.3 and 5.0a1 and 5.0b1 and 5.0 and 5.0.1 - 5.0.2 and 5.1b1 and 5.1 and 5.1.1 and 6.0a1 and 6.0b1 and 6.0 and 6.0.1 - 6.0.4 and 6.1b1 and 6.1b2 and 6.1 and 6.2b1 and 6.2b2 and 6.2 and 6.3b1 and 6.3 and 6.3.1 - 6.3.3 and 6.4b1 and 6.4 and 6.4.1 - 6.4.2 and 6.5b1 and 6.5 and 6.5.1 - 6.5.8 GHSA-3hv7-mjh2-fv65
0.2 and 1.0 and 1.1 and 1.1.1 and 1.2 and 1.2.1 and 2.0 and 2.1 and 2.1.1 and 2.2 and 2.2.1 and 2.3 and 2.4 and 2.4.1 and 3.0 and 3.0.1 - 3.0.2 and 3.1 and 3.1.1 and 3.2 and 3.2.1 - 3.2.2 and 4.0 and 4.0.1 - 4.0.2 and 4.1b2 and 4.1 and 4.2b1 and 4.2 and 4.2.1 and 4.3b1 and 4.3b2 and 4.3 and 4.4b1 and 4.4 and 4.4.1 - 4.4.3 and 4.5b1 and 4.5b2 and 4.5 and 4.5.1 - 4.5.3 and 5.0a1 and 5.0b1 and 5.0 and 5.0.1 - 5.0.2 and 5.1b1 and 5.1 and 5.1.1 and 6.0a1 and 6.0b1 and 6.0 and 6.0.1 - 6.0.4 and 6.1b1 and 6.1b2 and 6.1 and 6.2b1 and 6.2b2 and 6.2 and 6.3b1 and 6.3 and 6.3.1 - 6.3.3 and 6.4b1 and 6.4 and 6.4.1 - 6.4.2 and 6.5b1 and 6.5 and 6.5.1 - 6.5.8 GHSA-3hv7-mjh2-fv65
High Risk
1 month ago
tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
0.2 and 1.0 and 1.1 and 1.1.1 and 1.2 and 1.2.1 and 2.0 and 2.1 and 2.1.1 and 2.2 and 2.2.1 and 2.3 and 2.4 and 2.4.1 and 3.0 and 3.0.1 - 3.0.2 and 3.1 and 3.1.1 and 3.2 and 3.2.1 - 3.2.2 and 4.0 and 4.0.1 - 4.0.2 and 4.1b2 and 4.1 and 4.2b1 and 4.2 and 4.2.1 and 4.3b1 and 4.3b2 and 4.3 and 4.4b1 and 4.4 and 4.4.1 - 4.4.3 and 4.5b1 and 4.5b2 and 4.5 and 4.5.1 - 4.5.3 and 5.0a1 and 5.0b1 and 5.0 and 5.0.1 - 5.0.2 and 5.1b1 and 5.1 and 5.1.1 and 6.0a1 and 6.0b1 and 6.0 and 6.0.1 - 6.0.4 and 6.1b1 and 6.1b2 and 6.1 and 6.2b1 and 6.2b2 and 6.2 and 6.3b1 and 6.3 and 6.3.1 - 6.3.3 and 6.4b1 and 6.4 and 6.4.1 - 6.4.2 and 6.5b1 and 6.5 and 6.5.1 - 6.5.8 GHSA-chx6-46f5-w4vp
0.2 and 1.0 and 1.1 and 1.1.1 and 1.2 and 1.2.1 and 2.0 and 2.1 and 2.1.1 and 2.2 and 2.2.1 and 2.3 and 2.4 and 2.4.1 and 3.0 and 3.0.1 - 3.0.2 and 3.1 and 3.1.1 and 3.2 and 3.2.1 - 3.2.2 and 4.0 and 4.0.1 - 4.0.2 and 4.1b2 and 4.1 and 4.2b1 and 4.2 and 4.2.1 and 4.3b1 and 4.3b2 and 4.3 and 4.4b1 and 4.4 and 4.4.1 - 4.4.3 and 4.5b1 and 4.5b2 and 4.5 and 4.5.1 - 4.5.3 and 5.0a1 and 5.0b1 and 5.0 and 5.0.1 - 5.0.2 and 5.1b1 and 5.1 and 5.1.1 and 6.0a1 and 6.0b1 and 6.0 and 6.0.1 - 6.0.4 and 6.1b1 and 6.1b2 and 6.1 and 6.2b1 and 6.2b2 and 6.2 and 6.3b1 and 6.3 and 6.3.1 - 6.3.3 and 6.4b1 and 6.4 and 6.4.1 - 6.4.2 and 6.5b1 and 6.5 and 6.5.1 - 6.5.8 GHSA-chx6-46f5-w4vp
View all vulnerabilities for these packages

Impacted packages

Timeline

Published
4 hours ago
November 13, 2026 at 08:31 PM UTC
Fixed (6.6.1)
4 days ago
November 09, 2026 at 09:09 PM UTC
Last Modified
4 hours ago
November 13, 2026 at 08:45 PM UTC