CVE-2026-49854

A flaw was found in Tornado, a Python web framework. The optional native extension tornado.speedups did not properly validate the mask argument in its websocket_mask function. This allowed the C function to read beyond the intended buffer, potentially exposing up to three bytes of uninitialized memory. This vulnerability can be triggered when the native extension is active and Tornado's Cross-Site Request Forgery (XSRF) token decoder is in use, leading to information disclosure.

This Moderate vulnerability in the Tornado web framework's optional native extension, tornado.speedups, could lead to information disclosure. When the native extension is active and the XSRF token decoder is in use, an out-of-bounds read of up to three bytes of uninitialized memory may occur. This limited data exposure is contingent on specific configurations and does not directly lead to broader system compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.