CVE-2026-126347 · Package
NO FIX YET · SEE WHAT TO DO
Tornado's RedirectHandler can be tricked into sending a user to an attacker's site when a URL template lets attacker input shape the destination, using three or more leading slashes. Python and browsers parse such URLs differently, so the crafted destination reaches an outside host.
first public Nov 9, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use tornado.web.RedirectHandler with URL templates where attacker-controlled input can influence the redirect destination. Applications that only use fixed redirect targets are not exposed. The advisory describes versions through 6.6.0 as affected.
Not affected if static-redirect-targets, tornado-6.6.1-or-later
Who cares python, tornado, web-apps
python -c "import tornado; print(tornado.version)"RedirectHandler and look for redirect URLs built from user-supplied values6.6.1Tornado is a Python web framework and asynchronous networking library. In versions through 6.6.0, applications using tornado.web.RedirectHandler with URL templates that allow attacker-controlled substitutions to influence the destination can be vulnerable to an open redirect using three or more leading slashes. Differences between Python’s URL parsing and browser URL interpretation allow a crafted destination to redirect a user to an attacker-controlled host. The remediation for CVE-2026-116578 in version 6.6.0 did not fully address this case. This issue is fixed in version 6.6.1.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.