CVE-2026-49854

What it actually does

Out-of-bounds read of up to three bytes in the native websocket_mask implementation when the mask argument is shorter than four bytes, triggered via XSRF token decoding with the tornado.speedups extension enabled.

Why it matters to the business

Attackers may obtain small fragments of process memory that could contain sensitive application data, increasing risk of information disclosure in high-volume or exposed Tornado deployments.

How an attack unfolds

An attacker sends a crafted request that causes Tornado to decode an XSRF token while the native speedups extension is active; the websocket_mask C function then reads beyond the supplied mask buffer, leaking adjacent memory bytes.

How to fix it

Upgrade Tornado to version 6.5.6 or later; if immediate upgrade is not possible, disable the native speedups extension by ensuring the pure-Python implementation is used.

How to confirm the fix worked

Confirm Tornado version is 6.5.6 or newer; test that websocket_mask calls enforce a four-byte mask and that XSRF token handling no longer triggers the native extension on malformed input.

Typical attack path

1. Identify a Tornado application using the optional native speedups extension
2. Craft a request that invokes XSRF token decoding logic
3. Supply a mask shorter than four bytes to trigger the native websocket_mask path
4. Read the leaked memory bytes returned in the response or side channel

How to detect it

Review application logs for unusual XSRF token processing errors or crashes around websocket handling; correlate with native extension loading indicators in startup logs; no widespread exploitation artifacts are known.

What your security team should do

• Prioritize upgrade to Tornado 6.5.6 across all deployments within standard change windows
• Audit environments for explicit use of tornado.speedups and remove or isolate such configurations
• Add Tornado version checks to dependency scanning and SBOM processes