| Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunksCVE-2026-115927 · GHSA-R4J5-9XPP-3985 |
tornadoLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Tornado: Quadratic CPU usage when parsing HTTP headers with line foldingCVE-2026-116577 · GHSA-PCG2-G6CJ-Q92C |
tornadoLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Tornado: Open redirect in RedirectHandler via protocol-relative URLsCVE-2026-116578 · GHSA-PW9P-V7R6-GX4P |
tornadoLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| dnspython dns.name.from_wire_parser() excessive CPU useCVE-2026-114605 · GHSA-45C3-73F7-PV4M |
dnspythonAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Tornado has a CRLF injection in CurlAsyncHTTPClient headersCVE-2024-58384 · GHSA-W235-7P84-XX57 |
tornadoExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornadoCVE-2024-14029 · GHSA-753J-MPMX-QQ6G |
tornadoRed Hat Enterprise Linux 7/python-tornado |
PyPIRed Hat |
Medium
|
Fix reported |
|
| tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)CVE-2026-91990 · GHSA-8423-8FGW-73VQ |
tornadoExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuseCVE-2026-91992 · GHSA-PW6J-QG29-8W7F |
tornadoExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| WebOb: Open redirect in Location header normalization via leading C0 control / space charactersCVE-2026-54770 · GHSA-6HX8-3WJJ-GR8GVersion ranges need review. |
webobRed Hat Ceph Storage 4/python-webob |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loopCVE-2026-82397 · GHSA-MPF4-983Q-P7J4Version ranges need review. |
tornadoLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| sqlparse: Quadratic O(n²) DoS in group_commentsCVE-2026-71491 · GHSA-F2FF-P2WW-7P4PVersion ranges need review. |
sqlparseRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
High
|
Fix reported |
|
| sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashesCVE-2026-59894 · GHSA-3496-9G83-7V6XVersion ranges need review. |
sqlparseRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)CVE-2026-59893 · GHSA-PRG7-HCFM-MFCRVersion ranges need review. |
sqlparseRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
High
|
Fix reported |
|
| sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps triggerCVE-2026-54284 · GHSA-PWGV-4X5Q-6M9FVersion ranges need review. |
sqlparseRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
High
|
Fix reported |
|
| libsodium has Incomplete List of Disallowed InputsCVE-2025-69277 · GHSA-MRFV-M5WM-5W6WVersion ranges need review. |
paragonie/sodium_compathdwallet |
ComposerPyPIRed Hat |
Medium
|
Fix reported |
|
| Tornado vulnerable to Header Injection and XSS via reason argumentCVE-2025-67724 · GHSA-PR2V-JX2C-WG9FVersion ranges need review. |
tornadoExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| `lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributesCVE-2026-49825 · GHSA-4JHM-JV67-739FVersion ranges need review. |
lxml-html-cleanLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| ironic: OpenStack Ironic: Information disclosure via crafted requestCVE-2026-71201 |
Red Hat OpenShift Container Platform 4/openshift4/ose-baremetal-rhel8-operatorRed Hat OpenShift Container Platform 4/openshift4/ose-baremetal-rhel9-operator |
Red Hat |
Medium
|
No fix reported |
|
| openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmissionCVE-2026-84782 |
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9Confidential Compute Attestation/agent-sandbox/agent-sandbox-router |
Red Hat |
High
|
No fix reported |
|
| tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClientCVE-2026-103262 |
Lightspeed Core/lightspeed-core/lightspeed-stack-rhel9Lightspeed Core/lightspeed-core/rag-tool-cpu-rhel9 |
Red Hat |
High
|
No fix reported |
|
