Back to Security Advisories

Tornado Regression — Ubuntu Security Update (USN-8952-2)

USN-8952-2 corrects a regression in the earlier Tornado update: the incomplete fix for CVE-2026-103263 broke static file serving for applications subclassing Tornado (CWE-59 link-following context), alongside CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992 and CVE-2026-103262 (aggregate CVSS 5.9). Update: sudo apt update && sudo apt upgrade tornado and restart Tornado-based services.

High 5.9 CVSS
Ubuntu 20.04 Ubuntu 22.04

What this means under a SharedLicense license

The regression broke static file serving in Tornado-subclassed apps — either breaking the application or, before this correction, serving files through unintended paths.

  1. Ubuntu Security Notices

  2. USN-8952-2

Publication date

6 November 2026

Overview

USN-8952-1 introduced a regression in Tornado

Releases


26.10


26.04 LTS


24.04 LTS


22.04 LTS


20.04 LTS


18.04 LTS


16.04 LTS

Packages

Details

USN-8952-1 fixed vulnerabilities in Tornado. Unfortunately that update was incomplete due
to an incomplete fix for CVE-2026-103263, which broke static file
serving for applications that subclass Tornado’s StaticFileHandler,
such as Jupyter, and could introduce a regression. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that Tornado did not properly handle certain HTTP requests
and network inputs. An attacker could possibly use these issues to cause a
denial of service, expose sensitive information, or bypass access controls.

(CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992,
CVE-2026-103262,

USN-8952-1 fixed vulnerabilities in Tornado. Unfortunately that update was incomplete due
to an incomplete fix for CVE-2026-103263, which broke static file
serving for applications that subclass Tornado’s StaticFileHandler,
such as Jupyter, and could introduce a regression. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that Tornado did not properly handle certain HTTP requests
and network inputs. An attacker could possibly use these issues to cause a
denial of service, expose sensitive information, or bypass access controls.

(CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992,
CVE-2026-103262, CVE-2026-103263)

Show more
Show less

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
26.10

stonking

 python3-tornado – 

6.5.5-5ubuntu1.2
26.04

LTS resolute

 python3-tornado – 

6.5.4-0.1ubuntu0.3
24.04

LTS noble

 python3-tornado – 

6.4.0-1ubuntu0.7
22.04

LTS jammy

 python3-tornado – 

6.1.0-3ubuntu0.1~esm7

Ubuntu Pro
Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.

20.04

LTS focal

 python3-tornado – 

6.0.3+really5.1.1-3ubuntu0.1~esm8

Ubuntu Pro
Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.

18.04

LTS bionic

 python3-tornado – 

4.5.3-1ubuntu0.2+esm5

Ubuntu Pro
Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.

16.04

LTS xenial

 python3-tornado – 

4.2.1-1ubuntu3.1+esm5

Ubuntu Pro
Fix available with Ubuntu Pro via Legacy Support add-on.

References

Related notices

Frequently Asked Questions

What is USN-8952-2?
It is Ubuntu's follow-up to USN-8952-1: the original Tornado security update contained an incomplete fix for CVE-2026-103263 that broke static file serving for Tornado subclasses. This notice delivers the corrected implementation along with fixes for CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992 and CVE-2026-103262 (aggregate CVSS 5.9, CWE-59 link-following context).
Who is affected?
Ubuntu servers running Tornado-based Python applications — web services, IMAP/mail platforms on Twisted-adjacent stacks and any Tornado-subclassed application.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade for the tornado packages and restart the Tornado-based services so they run the corrected implementation.
Why do security fixes keep needing follow-ups?
Incomplete fixes are common when the original patch addresses the reported case but not adjacent paths — the follow-up (USN-8952-2) delivers the complete correction, which is why backport waves ship as -2, -3 notices.

References

Security Advisories

Related Advisories

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System