CVE-2026-116578: CVE-2026-116578: Open Redirect in Tornado RedirectHandler via URL Normalization and Template Substitution
CVE-2026-116578: Open Redirect in Tornado RedirectHandler via URL Normalization and Template Substitution Vulnerability ID: CVE-2026-116578 CVSS Score: 2.1 Published: 2026-10-28 Tornado versions prior to 6.6.0 contain an open redirect vulnerability (CWE-601) in tornado.web.RedirectHandler. When route templates incorporate regular expression capture groups at the start of a path, directly after a…
A new security flaw has been identified in Tornado, an open-source web framework written in Python. This vulnerability, known as CVE-2026-116578, allows for open redirects when using the Tornado RedirectHandler. The issue stems from URL normalization and template substitution practices within the framework.
Version 6.6.0 of Tornado includes a patch to address this vulnerability, making it crucial for developers to upgrade to this version or a later one as soon as possible. Prior to this fix, web applications using Tornado versions lower than 6.6.0 may be at risk of being manipulated by malicious actors who exploit this vulnerability.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
