CVE-2026-126347

LOW

INFO Priority: 0.01 BB Relevance: 46/100

Published: 2026-11-12 Modified: 2026-11-13 First seen: 2026-11-12 Status: active

Attack Surface

Network No Auth

CVSS Vector Breakdown

AV: Network

AC: High

PR: None

UI: Required

S: Unchanged

C: None

I: Low

A: None

Description

Tornado is a Python web framework and asynchronous networking library. In versions through 6.6.0, applications using tornado.web.RedirectHandler with URL templates that allow attacker-controlled substitutions to influence the destination can be vulnerable to an open redirect using three or more leading slashes. Differences between Python’s URL parsing and browser URL interpretation allow a crafted destination to redirect a user to an attacker-controlled host. The remediation for CVE-2026-116578 in version 6.6.0 did not fully address this case. This issue is fixed in version 6.6.1.