What is CVE-2026-49853?

CVE-2026-49853 is a high-severity vulnerability in Tornadoweb Tornado, classified under Information Disclosure. CVSS score: 7.7/10. Published 2026-07-14.

How severe is CVE-2026-49853?

High severity. CVSS v3 base score is 7.7 out of 10.

Information disclosure in Tornadoweb Tornado

CVE-2026-49853

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth…

Vulnerability class: Information Disclosure

CVSS v3 metric

CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.

Affected products

Tornadoweb Tornado — versions < 6.5.6

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-49853?: CVE-2026-49853 is a high-severity vulnerability in Tornadoweb Tornado, classified under Information Disclosure. CVSS score: 7.7/10. Published 2026-07-14.
How severe is CVE-2026-49853?: High severity. CVSS v3 base score is 7.7 out of 10.