USN-8952-1

Type: Security

Severity: Medium

Published: 2026-10-22

Ubuntu 24.04 LTS (Noble Numbat)

Ubuntu 22.04 LTS (Jammy Jellyfish)

Ubuntu 26.10 (Stonking Stingray)

Ubuntu 26.04 LTS (Resolute Raccoon)

Ubuntu 20.04 LTS (Focal Fossa)

It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls. (CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992, CVE-2026-103262, CVE-2026-103263) Update Instructions: Run `sudo pro fix USN-8952-1` to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: python3-tornado - 6.4.0-1ubuntu0.6 No subscription required

Evidence and freshness

Data current

Last supporting evidence check: 2026-10-24T08:34:45.187Z UTC

Official vendor advisory

Ubuntu 24.04 LTS (Noble Numbat)

View source

Observed 2026-10-24T08:34:45.187Z UTC. Last updated 2026-10-23T06:08:41.737Z UTC.

Upstream Advisory

View official advisory

Affected Packages

python3-tornado 6.4.0-1ubuntu0.6-6.4.0-1ubuntu0.6
python3-tornado 6.1.0-3ubuntu0.1~esm6-6.1.0-3ubuntu0.1~esm6
python3-tornado 6.5.5-5ubuntu1.1-6.5.5-5ubuntu1.1
python3-tornado 6.5.4-0.1ubuntu0.2-6.5.4-0.1ubuntu0.2
python3-tornado 6.0.3+really5.1.1-3ubuntu0.1~esm7-6.0.3+really5.1.1-3ubuntu0.1~esm7

Interested in being alerted when there are new versions of python3-tornado, etc? Set up an alert.