Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 35 articles for you...
89
security advisorydenial of servicefedoraFedora 44 python-tornado Critical DoS Cookie Injection 2026-0f40de2581
Update to 6.5.7 - CVE-2026-35536 (rhbz#2457335), CVE-2026-31958 (rhbz#2451660). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-0f40de2581 2026-07-12 01:10:38.798604+00:00 -------------------------------------------------------------------------------- Name : python-tornado Product : Fedora 44 Version : 6.5.7 Release : 1.fc44 URL : https://www.tornadoweb.org Summary : Scalable, non-blocking web server and tools Description : Tornado is an open source version of the scalable, non-blocking web server and tools. The framework is distinct from most mainstream web server frameworks (and certainly most Python frameworks) because it is non-blocking and reasonably fast. Because it is non-blocking and uses epoll, it can handle thousands of simultaneous standing connections, which means it is ideal for real-time web services. -------------------------------------------------------------------------------- Update Information: Update to 6.5.7 - CVE-2026-35536 (rhbz#2457335), CVE-2026-31958 (rhbz#2451660) -------------------------------------------------------------------------------- ChangeLog: * Mon Jun 22 2026 Peter Robinson - 6.5.7-1 - Update to 6.5.7 - CVE-2026-35536 (rhbz#2457335), CVE-2026-31958 (rhbz#2451660) * Wed Jun 3 2026 Python Maint - 6.5.2-6 - Rebuilt for Python 3.15 * Tue May 19 2026 Karolina Surma - 6.5.2-5 - Fix compatibility with Python 3.15 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2451660 - CVE-2026-31958 python-tornado: Tornado: Denial of Service via large multipart bodies [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2451660 [ 2 ] Bug #2457335 - CVE-2026-35536 python-tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2457335 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-0f40de2581' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jul 11, 2026
•Important
Fedora
89
security advisorydenial of servicefedoraFedora Python-Tornado Critical Denial of Service Attack Fix 2026-23656e6d2f
Update to 6.5.7 - CVE-2026-35536 (rhbz#2457335), CVE-2026-31958 (rhbz#2451660). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-23656e6d2f 2026-07-12 00:58:35.903669+00:00 -------------------------------------------------------------------------------- Name : python-tornado Product : Fedora 43 Version : 6.5.7 Release : 1.fc43 URL : https://www.tornadoweb.org Summary : Scalable, non-blocking web server and tools Description : Tornado is an open source version of the scalable, non-blocking web server and tools. The framework is distinct from most mainstream web server frameworks (and certainly most Python frameworks) because it is non-blocking and reasonably fast. Because it is non-blocking and uses epoll, it can handle thousands of simultaneous standing connections, which means it is ideal for real-time web services. -------------------------------------------------------------------------------- Update Information: Update to 6.5.7 - CVE-2026-35536 (rhbz#2457335), CVE-2026-31958 (rhbz#2451660) -------------------------------------------------------------------------------- ChangeLog: * Mon Jun 22 2026 Peter Robinson - 6.5.7-1 - Update to 6.5.7 - CVE-2026-35536 (rhbz#2457335), CVE-2026-31958 (rhbz#2451660) * Wed Jun 3 2026 Python Maint - 6.5.2-6 - Rebuilt for Python 3.15 * Tue May 19 2026 Karolina Surma - 6.5.2-5 - Fix compatibility with Python 3.15 * Sat Jan 17 2026 Fedora Release Engineering - 6.5.2-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2451660 - CVE-2026-31958 python-tornado: Tornado: Denial of Service via large multipart bodies [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2451660 [ 2 ] Bug #2457335 - CVE-2026-35536 python-tornado: Tornado: Cookie attribute injection due to improper handlingof cookie arguments [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2457335 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-23656e6d2f' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jul 11, 2026
•Important
Fedora
203
security advisorycriticalDoSMageia Issues Advisory for Critical DoS Vulnerability in python-tornado
Security update. Publication date: 17 Jun 2026 URL: https://advisories.mageia.org/MGASA-2026-0216.html Type: security Affected Mageia releases: 9 CVE: CVE-2026-31958, CVE-2026-35536 Description: Tornado has a DoS due to too many multipart parts. (CVE-2026-31958) In Tornado, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters. (CVE-2026-35536) References: - https://bugs.mageia.org/show_bug.cgi?id=35420 - https://ubuntu.com/security/notices/USN-8198-1 - https://www.cve.org/CVERecord?id=CVE-2026-31958 - https://www.cve.org/CVERecord?id=CVE-2026-35536 SRPMS: - 9/core/python-tornado-6.3.2-1.4.mga9 . Mageia issues security advisory for python-tornado addressing critical Denial of Service and cookie injection issues. Updates recommended.. Mageia python tornado update security advisory. . Severity: Critical. LinuxSecurity.com Team
Jun 17, 2026
•Critical
Mageia
219
security advisorymoderatedenial of serviceUbuntu 22.04 Edition SEC-2023-45730 Significant DDoS Risks in Django-Python
Moderate: python-tornado security update. {"type": "TYPE_SECURITY", "shortCode": "RL", "name": "RLSA-2026:13641", "synopsis": "Moderate: python-tornado security update", "severity": "SEVERITY_MODERATE", "topic": "An update is available for python-tornado.\nThis update affects Rocky Linux 10.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list", "description": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)\n\n* tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "solution": null, "affectedProducts": ["Rocky Linux 10"], "fixes": [{"ticket": "2454716", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2454716", "description": ""}, {"ticket": "2446765", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2446765", "description": ""}], "cves": [{"name": "CVE-2026-31958", "sourceBy": "MITRE", "sourceLink": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31958", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvss3BaseScore": "5.3", "cwe": "CWE-770"}, {"name": "CVE-2026-35536", "sourceBy": "MITRE", "sourceLink": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35536", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "cvss3BaseScore": "5.4", "cwe": "CWE-88"}], "references": [], "publishedAt":"2026-05-06T12:05:16.751656Z", "rpms": {"Rocky Linux 10": {"nvras": ["python-tornado-debugsource-0:6.5.5-1.el10_1.1.s390x.rpm", "python3-tornado-0:6.5.5-1.el10_1.1.ppc64le.rpm", "python-tornado-debugsource-0:6.5.5-1.el10_1.1.aarch64.rpm", "python3-tornado-0:6.5.5-1.el10_1.1.x86_64.rpm", "python3-tornado-0:6.5.5-1.el10_1.1.aarch64.rpm", "python-tornado-debugsource-0:6.5.5-1.el10_1.1.ppc64le.rpm", "python-tornado-0:6.5.5-1.el10_1.1.src.rpm", "python3-tornado-debuginfo-0:6.5.5-1.el10_1.1.s390x.rpm", "python3-tornado-debuginfo-0:6.5.5-1.el10_1.1.x86_64.rpm", "python3-tornado-debuginfo-0:6.5.5-1.el10_1.1.ppc64le.rpm", "python3-tornado-0:6.5.5-1.el10_1.1.s390x.rpm", "python-tornado-debugsource-0:6.5.5-1.el10_1.1.x86_64.rpm", "python3-tornado-debuginfo-0:6.5.5-1.el10_1.1.aarch64.rpm"]}}, "rebootSuggested": false, "buildReferences": []}. A security advisory reporting a moderate python-tornado update affecting Rocky Linux, detailing risks and fixes.. python tornado security update, Rocky Linux 10, moderate security patch, denial of service exploit. . LinuxSecurity.com Team
May 06, 2026
Rocky Linux
219
security advisorymoderatedenial of serviceRocky Linux 9 RLSA-2026-14514 python-flask Low Risk Code Execution Threat
Moderate: python-tornado security update. {"type": "TYPE_SECURITY", "shortCode": "RL", "name": "RLSA-2026:13670", "synopsis": "Moderate: python-tornado security update", "severity": "SEVERITY_MODERATE", "topic": "An update is available for python-tornado.\nThis update affects Rocky Linux 9.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list", "description": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)\n\n* tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "solution": null, "affectedProducts": ["Rocky Linux 9"], "fixes": [{"ticket": "2446765", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2446765", "description": ""}, {"ticket": "2454716", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2454716", "description": ""}], "cves": [{"name": "CVE-2026-31958", "sourceBy": "MITRE", "sourceLink": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31958", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvss3BaseScore": "5.3", "cwe": "CWE-770"}, {"name": "CVE-2026-35536", "sourceBy": "MITRE", "sourceLink": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35536", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "cvss3BaseScore": "5.4", "cwe": "CWE-88"}], "references": [], "publishedAt":"2026-05-06T06:02:14.811706Z", "rpms": {"Rocky Linux 9": {"nvras": ["python3-tornado-0:6.5.5-1.el9_7.1.aarch64.rpm", "python3-tornado-0:6.5.5-1.el9_7.1.ppc64le.rpm", "python3-tornado-0:6.5.5-1.el9_7.1.s390x.rpm", "python3-tornado-0:6.5.5-1.el9_7.1.x86_64.rpm", "python3-tornado-debuginfo-0:6.5.5-1.el9_7.1.aarch64.rpm", "python3-tornado-debuginfo-0:6.5.5-1.el9_7.1.ppc64le.rpm", "python3-tornado-debuginfo-0:6.5.5-1.el9_7.1.s390x.rpm", "python3-tornado-debuginfo-0:6.5.5-1.el9_7.1.x86_64.rpm", "python-tornado-0:6.5.5-1.el9_7.1.src.rpm", "python-tornado-debugsource-0:6.5.5-1.el9_7.1.aarch64.rpm", "python-tornado-debugsource-0:6.5.5-1.el9_7.1.ppc64le.rpm", "python-tornado-debugsource-0:6.5.5-1.el9_7.1.s390x.rpm", "python-tornado-debugsource-0:6.5.5-1.el9_7.1.x86_64.rpm"]}}, "rebootSuggested": false, "buildReferences": []}. Rocky Linux python-tornado update addresses denial of service and cookie injection risks to enhance system security and performance.. python tornado, Rocky Linux security, software update, denial of service, cookie injection. . LinuxSecurity.com Team
May 06, 2026
Rocky Linux
172
security advisorydenial of serviceUbuntuUbuntu 26.04 LTS USN-8198-2 Tornado Important Denial of Service
Several security issues were fixed in Tornado.. ========================================================================== Ubuntu Security Notice USN-8198-2 April 28, 2026 python-tornado vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS Summary: Several security issues were fixed in Tornado. Software Description: - python-tornado: scalable, non-blocking web server and tools Details: USN-8198-1 fixed vulnerabilities in Tornado. This update provides the corresponding updates for Ubuntu 26.04 LTS. Original advisory details: It was discovered that Tornado incorrectly handled parsing of large multipart request bodies. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-31958) It was discovered that Tornado did not properly validate characters in cookie values. An attacker could possibly use this issue to inject arbitrary cookie attributes. (CVE-2026-35536) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS python3-tornado 6.5.4-0.1ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8198-2 https://ubuntu.com/security/notices/USN-8198-1 CVE-2026-31958, CVE-2026-35536 Package Information: https://launchpad.net/ubuntu/+source/python-tornado/6.5.4-0.1ubuntu0.1 . Stay protected: Ubuntu 26.04 LTS Tornado update fixes critical security flaws. Ensure your system is updated to avoid risks.. Ubuntu 26.04,Linux security,python-tornado vulnerabilities,Tornado Denial of Service,Cookie Injection. . Severity: Important. LinuxSecurity.com Team
Apr 28, 2026
•Important
Ubuntu
100
security advisorymoderatepatchSUSE: 2023:4650-1 Moderate: curl cookie injection and patch
* bsc#1215889 * bsc#1217573 Cross-References: * CVE-2023-38546 . # Security update for curl Announcement ID: SUSE-SU-2023:4650-1 Rating: moderate References: * bsc#1215889 * bsc#1217573 Cross-References: * CVE-2023-38546 * CVE-2023-46218 CVSS scores: * CVE-2023-38546 ( SUSE ): 4.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L * CVE-2023-38546 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2023-46218 ( SUSE ): 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N * CVE-2023-46218 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affected Products: * SUSE CaaS Platform 4.0 * SUSE Linux Enterprise High Performance Computing 15 SP1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 An update that solves two vulnerabilities can now be installed. ## Description: This update for curl fixes the following issues: * CVE-2023-38546: Fixed a cookie injection with none file (bsc#1215889). * CVE-2023-46218: Fixed cookie mixed case PSL bypass (bsc#1217573). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-4650=1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-4650=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-4650=1 * SUSE CaaS Platform 4.0 To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. ##Package List: * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (aarch64 x86_64) * curl-debuginfo-7.60.0-150000.56.1 * curl-debugsource-7.60.0-150000.56.1 * libcurl-devel-7.60.0-150000.56.1 * curl-7.60.0-150000.56.1 * libcurl4-debuginfo-7.60.0-150000.56.1 * libcurl4-7.60.0-150000.56.1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (x86_64) * libcurl4-32bit-debuginfo-7.60.0-150000.56.1 * libcurl4-32bit-7.60.0-150000.56.1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (aarch64 ppc64le s390x x86_64) * curl-debuginfo-7.60.0-150000.56.1 * curl-debugsource-7.60.0-150000.56.1 * libcurl-devel-7.60.0-150000.56.1 * curl-7.60.0-150000.56.1 * libcurl4-debuginfo-7.60.0-150000.56.1 * libcurl4-7.60.0-150000.56.1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (x86_64) * libcurl4-32bit-debuginfo-7.60.0-150000.56.1 * libcurl4-32bit-7.60.0-150000.56.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 (ppc64le x86_64) * curl-debuginfo-7.60.0-150000.56.1 * curl-debugsource-7.60.0-150000.56.1 * libcurl-devel-7.60.0-150000.56.1 * curl-7.60.0-150000.56.1 * libcurl4-debuginfo-7.60.0-150000.56.1 * libcurl4-7.60.0-150000.56.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 (x86_64) * libcurl4-32bit-debuginfo-7.60.0-150000.56.1 * libcurl4-32bit-7.60.0-150000.56.1 * SUSE CaaS Platform 4.0 (x86_64) * libcurl4-32bit-7.60.0-150000.56.1 * curl-debuginfo-7.60.0-150000.56.1 * libcurl4-32bit-debuginfo-7.60.0-150000.56.1 * curl-debugsource-7.60.0-150000.56.1 * libcurl-devel-7.60.0-150000.56.1 * curl-7.60.0-150000.56.1 * libcurl4-debuginfo-7.60.0-150000.56.1 * libcurl4-7.60.0-150000.56.1 ## References: * https://www.suse.com/security/cve/CVE-2023-38546.html * https://www.suse.com/security/cve/CVE-2023-46218.html * https://bugzilla.suse.com/show_bug.cgi?id=1215889 * https://bugzilla.suse.com/show_bug.cgi?id=1217573 . Thenewest curl enhancement addresses significant security vulnerabilities within SUSE offerings, boosting system dependability and threat mitigation.. Curl Update, SUSE Security Advisory, Cookie Injection Fix, SUSE Linux Enterprise, Server Patch. . LinuxSecurity.com Team
Dec 14, 2023
SuSE
217
security advisorysecurity updatecritical fixOracle Linux 9 ELSA-2023-6745 Critical: Curl Cookie Injection Issue
The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: . Oracle Linux Security Advisory ELSA-2023-6745 https://linux.oracle.com/errata/ELSA-2023-6745.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: x86_64: curl-7.76.1-26.el9_3.2.x86_64.rpm curl-minimal-7.76.1-26.el9_3.2.x86_64.rpm libcurl-7.76.1-26.el9_3.2.i686.rpm libcurl-7.76.1-26.el9_3.2.x86_64.rpm libcurl-devel-7.76.1-26.el9_3.2.i686.rpm libcurl-devel-7.76.1-26.el9_3.2.x86_64.rpm libcurl-minimal-7.76.1-26.el9_3.2.i686.rpm libcurl-minimal-7.76.1-26.el9_3.2.x86_64.rpm aarch64: curl-7.76.1-26.el9_3.2.aarch64.rpm curl-minimal-7.76.1-26.el9_3.2.aarch64.rpm libcurl-7.76.1-26.el9_3.2.aarch64.rpm libcurl-devel-7.76.1-26.el9_3.2.aarch64.rpm libcurl-minimal-7.76.1-26.el9_3.2.aarch64.rpm SRPMS: https://oss.oracle.com:443/ol9/SRPMS-updates//curl-7.76.1-26.el9_3.2.src.rpm Related CVEs: CVE-2023-38545 CVE-2023-38546 Description of changes: [7.76.1-26.el9_3.2] - fix cookie injection with none file (CVE-2023-38546) [7.76.1-26.el9_3.1] - socks: return error if hostname too long for remote resolve (CVE-2023-38545) _______________________________________________ El-errata mailing list
Nov 17, 2023
•Critical
Oracle
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!