Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116578— Tornado: Open redirect in RedirectHandler via protocol-relative URLs

Quick assessment

Affected
tornadoweb tornado
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Tornado 是一个 Python Web 框架和异步网络库。在 6.6 版本之前， 的 URL 模板允许在正则表达式捕获组的位置进行替换，而攻击者可通过构造特定的请求路径，改变重定向的协议或网络目标。受影响的替换位置包括：路径起始处、固定主机名之后，或模板开头。这些位置可能包含被浏览器解释为攻击者可控目标的多种变体，例如协议相对路径、绝对路径、反斜杠路径、编码路径、主机扩展路径以及包含用户信息的路径。静态模板以及在固定主机名后紧跟斜杠的替换位置不受影响。攻击者可利用由此产生的开放重定向漏洞，在应用程序的域名上实

CVSS 2.1 · Low
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-116578

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Tornado: Open redirect in RedirectHandler via protocol-relative URLs
Source: CVE Program / CVE List V5
Vulnerability Description
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
tornadoweb tornado < 6.6 -

II. Public POCs for CVE-2026-116578

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116578

请登录查看更多情报信息。

Other References for CVE-2026-116578 (6)

Same Patch Batch · tornadoweb · 2026-10-26 · 3 CVEs total

CVE-2026-116577 5.3 MEDIUM Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
CVE-2026-115927 5.3 MEDIUM Tornado: Event loop blocking and excess memory use from chunked bodies with many small chu

IV. Related Vulnerabilities

Same product: tornado
Same vendor: tornadoweb
Same weakness: CWE-601