USN-8952-1: Ubuntu patches six DoS vulnerabilities in Tornado, Python web library

Ubuntu published advisory USN-8952-1 on 22 October 2026 for the python3-tornado package, an asynchronous web library widely used in Python to handle large numbers of simultaneous connections (long polling, WebSocket) and present as a dependency in tools like JupyterLab. Anyone running Ubuntu servers with Tornado-based applications should update the package.

The six vulnerabilities

The advisory groups six CVEs: CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992, CVE-2026-103262, CVE-2026-103263. Tornado did not correctly handle certain HTTP requests and network input, and an attacker could exploit these issues to cause a denial of service, expose sensitive information or bypass access controls.

Two of the more recent flaws have been better documented by other sources. CVE-2026-103262 concerns the optional CurlAsyncHTTPClient HTTP client: a malicious server can return a small, highly compressed payload that expands to an enormous size, exhausting memory and crashing the application. Tornado's default client is not affected: SimpleAsyncHTTPClient includes built-in thresholds for payload sizes and is not vulnerable to this issue, whereas systems that explicitly configure CurlAsyncHTTPClient do not enforce these limits. Those using Tornado only with the default client are therefore exposed to a lesser extent to this specific CVE, but remain vulnerable to the other five flaws fixed in the same update.

CVE-2026-91990 concerns multipart form parsing: Tornado prior to 6.5.8 contained a memory amplification vulnerability in parse_multipart_form_data, which split multipart data before validating the max_parts limit, with the body constrained only by max_buffer_size (default 104857600 bytes).

Fixed versions by release

Ubuntu Release	Codename	Package version	Notes
26.10	stonking	python3-tornado 6.5.5-5ubuntu1.1	standard repository
26.04 LTS	resolute	python3-tornado 6.5.4-0.1ubuntu0.2	standard repository
24.04 LTS	noble	python3-tornado 6.4.0-1ubuntu0.6	standard repository
22.04 LTS	jammy	python3-tornado 6.1.0-3ubuntu0.1~esm6	requires Ubuntu Pro (ESM Apps)
20.04 LTS	focal	python3-tornado 6.0.3+really5.1.1-3ubuntu0.1~esm7	requires Ubuntu Pro (ESM Apps)
18.04 LTS	bionic	python3-tornado 4.5.3-1ubuntu0.2+esm4	requires Ubuntu Pro (ESM Apps)
16.04 LTS	xenial	python3-tornado 4.2.1-1ubuntu3.1+esm4	requires Ubuntu Pro (Legacy Support)

On 26.10, 26.04 and 24.04, a standard package update is sufficient. On older releases (22.04, 20.04, 18.04, 16.04) the patch is available only via Ubuntu Pro subscription, which is free for up to five machines.