Tornado is a Python web framework and asynchronous networking library. In versions through 6.6.0, applications using tornado.web.RedirectHandler with URL templates that allow attacker-controlled substitutions to influence the destination can be vulnerable to an open redirect using three or more leading slashes. Differences between Python’s URL parsing and browser URL interpretation allow a crafted destination to redirect a user to an attacker-controlled host. The remediation for CVE-2026-116578 in version 6.6.0 did not fully address this case. This issue is fixed in version 6.6.1.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 12 Nov 2026 22:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Tornado is a Python web framework and asynchronous networking library. In versions through 6.6.0, applications using tornado.web.RedirectHandler with URL templates that allow attacker-controlled substitutions to influence the destination can be vulnerable to an open redirect using three or more leading slashes. Differences between Python’s URL parsing and browser URL interpretation allow a crafted destination to redirect a user to an attacker-controlled host. The remediation for CVE-2026-116578 in version 6.6.0 did not fully address this case. This issue is fixed in version 6.6.1. | |
| Title | Tornado: Open redirect via triple-slash redirect paths | |
| Weaknesses | CWE-601 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-11-12T21:52:22.374Z
Reserved: 2026-11-10T21:12:01.227Z
Link: CVE-2026-126347
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-12T22:19:19.767
Modified: 2026-11-12T22:19:19.900
Link: CVE-2026-126347
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses