An update for python-tornado is now available for openEuler-24.03-LTS-SP3,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP2 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-1903 Final 1.0 1.0 2026-04-11 Initial 2026-04-11 2026-04-11 openEuler SA Tool V1.0 2026-04-11 python-tornado security update An update for python-tornado is now available for openEuler-24.03-LTS-SP3,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP2 Tornado is an open source version of the scalable, non-blocking web server and tools. Security Fix(es): Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom "reason" phrases (the "Not Found" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). This issue is fixed in version 6.5.3.(CVE-2025-67724) In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.(CVE-2026-35536) An update for python-tornado is now available for openEuler-24.03-LTS-SP3,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP2. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High python-tornado https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1903 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-67724 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-35536 https://nvd.nist.gov/vuln/detail/CVE-2025-67724 https://nvd.nist.gov/vuln/detail/CVE-2026-35536 openEuler-24.03-LTS-SP3 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP2 python-tornado-6.5-4.oe2403sp3.src.rpm python-tornado-5.0.2-12.oe2003sp4.src.rpm python-tornado-6.1-7.oe2203sp4.src.rpm python-tornado-6.5-4.oe2403.src.rpm python-tornado-6.5-4.oe2403sp1.src.rpm python-tornado-6.5-4.oe2403sp2.src.rpm python-tornado-debuginfo-6.5-4.oe2403sp3.aarch64.rpm python-tornado-debugsource-6.5-4.oe2403sp3.aarch64.rpm python-tornado-help-6.5-4.oe2403sp3.aarch64.rpm python3-tornado-6.5-4.oe2403sp3.aarch64.rpm python-tornado-debuginfo-5.0.2-12.oe2003sp4.aarch64.rpm python-tornado-debugsource-5.0.2-12.oe2003sp4.aarch64.rpm python2-tornado-5.0.2-12.oe2003sp4.aarch64.rpm python3-tornado-5.0.2-12.oe2003sp4.aarch64.rpm python-tornado-debuginfo-6.1-7.oe2203sp4.aarch64.rpm python-tornado-debugsource-6.1-7.oe2203sp4.aarch64.rpm python-tornado-help-6.1-7.oe2203sp4.aarch64.rpm python3-tornado-6.1-7.oe2203sp4.aarch64.rpm python-tornado-debuginfo-6.5-4.oe2403.aarch64.rpm python-tornado-debugsource-6.5-4.oe2403.aarch64.rpm python-tornado-help-6.5-4.oe2403.aarch64.rpm python3-tornado-6.5-4.oe2403.aarch64.rpm python-tornado-debuginfo-6.5-4.oe2403sp1.aarch64.rpm python-tornado-debugsource-6.5-4.oe2403sp1.aarch64.rpm python-tornado-help-6.5-4.oe2403sp1.aarch64.rpm python3-tornado-6.5-4.oe2403sp1.aarch64.rpm python-tornado-debuginfo-6.5-4.oe2403sp2.aarch64.rpm python-tornado-debugsource-6.5-4.oe2403sp2.aarch64.rpm python-tornado-help-6.5-4.oe2403sp2.aarch64.rpm python3-tornado-6.5-4.oe2403sp2.aarch64.rpm python-tornado-debuginfo-6.5-4.oe2403sp3.x86_64.rpm python-tornado-debugsource-6.5-4.oe2403sp3.x86_64.rpm python-tornado-help-6.5-4.oe2403sp3.x86_64.rpm python3-tornado-6.5-4.oe2403sp3.x86_64.rpm python-tornado-debuginfo-5.0.2-12.oe2003sp4.x86_64.rpm python-tornado-debugsource-5.0.2-12.oe2003sp4.x86_64.rpm python2-tornado-5.0.2-12.oe2003sp4.x86_64.rpm python3-tornado-5.0.2-12.oe2003sp4.x86_64.rpm python-tornado-debuginfo-6.1-7.oe2203sp4.x86_64.rpm python-tornado-debugsource-6.1-7.oe2203sp4.x86_64.rpm python-tornado-help-6.1-7.oe2203sp4.x86_64.rpm python3-tornado-6.1-7.oe2203sp4.x86_64.rpm python-tornado-debuginfo-6.5-4.oe2403.x86_64.rpm python-tornado-debugsource-6.5-4.oe2403.x86_64.rpm python-tornado-help-6.5-4.oe2403.x86_64.rpm python3-tornado-6.5-4.oe2403.x86_64.rpm python-tornado-debuginfo-6.5-4.oe2403sp1.x86_64.rpm python-tornado-debugsource-6.5-4.oe2403sp1.x86_64.rpm python-tornado-help-6.5-4.oe2403sp1.x86_64.rpm python3-tornado-6.5-4.oe2403sp1.x86_64.rpm python-tornado-debuginfo-6.5-4.oe2403sp2.x86_64.rpm python-tornado-debugsource-6.5-4.oe2403sp2.x86_64.rpm python-tornado-help-6.5-4.oe2403sp2.x86_64.rpm python3-tornado-6.5-4.oe2403sp2.x86_64.rpm Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom "reason" phrases (the "Not Found" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). This issue is fixed in version 6.5.3. 2026-04-11 CVE-2025-67724 openEuler-24.03-LTS-SP3 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP2 Medium 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N python-tornado security update 2026-04-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1903 In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters. 2026-04-11 CVE-2026-35536 openEuler-24.03-LTS-SP3 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP2 High 7.2 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N python-tornado security update 2026-04-11 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1903