{
  "id": 16982482,
  "title": "CVE-2026-116578: CVE-2026-116578: Open Redirect in Tornado RedirectHandler via URL Normalization and Template Substitution",
  "url": "https://urgent.news/2026/10/29/cve-2026-116578-cve-2026-116578-open-redirect-in-tornado",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-29T00:30:51.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/cverports/cve-2026-116578-cve-2026-116578-open-redirect-in-tornado-redirecthandler-via-url-normalization-3lnn"
  },
  "original_language": "en",
  "account": "A new security flaw has been identified in Tornado, an open-source web framework written in Python. This vulnerability, known as CVE-2026-116578, allows for open redirects when using the Tornado RedirectHandler. The issue stems from URL normalization and template substitution practices within the framework.\n\nVersion 6.6.0 of Tornado includes a patch to address this vulnerability, making it crucial for developers to upgrade to this version or a later one as soon as possible. Prior to this fix, web applications using Tornado versions lower than 6.6.0 may be at risk of being manipulated by malicious actors who exploit this vulnerability.",
  "summary": "CVE-2026-116578: Open Redirect in Tornado RedirectHandler via URL Normalization and Template Substitution Vulnerability ID: CVE-2026-116578 CVSS Score: 2.1 Published: 2026-10-28 Tornado versions prior to 6.6.0 contain an open redirect vulnerability (CWE-601) in tornado.web.RedirectHandler. When route templates incorporate regular expression capture groups at the start of a path, directly after a…",
  "key_points": [
    "CVE-2026-116578 is an open redirect vulnerability in Tornado.",
    "Affected versions are those lower than 6.6.0.",
    "Upgrade to 6.6.0 or later to mitigate risk."
  ],
  "editors_take": "Flaws in how the framework handles URL normalization and template substitution force developers to prioritize immediate upgrades to prevent malicious actors from manipulating web application redirects.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}