CVE-2026-126347: Tornado: Open redirect via triple-slash redirect paths

November 13, 2026

Due to differences in the way browsers and Python’s urllib parse urls, browsers treat a string starting with three or more slashes as a protocol-level redirect, while urllib does not. This means that the 6.6.0 fix for the RedirectHandler open redirect (CVE-2026-116578, commit cc75ab0e) is incomplete. Tornado 6.6.1 improves the open-redirect detection to handle this case correctly, as well as fixing a regression in the 6.6.0 implementation.

References

github.com/advisories/GHSA-5cjw-f85j-cv6r
github.com/tornadoweb/tornado/commit/c503241622c0efe7c40110d89834ce8b7fead1e4
github.com/tornadoweb/tornado/releases/tag/v6.6.1
github.com/tornadoweb/tornado/security/advisories/GHSA-5cjw-f85j-cv6r
nvd.nist.gov/vuln/detail/CVE-2026-126347

Code Behaviors & Features

Detect and mitigate CVE-2026-126347 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →