# Ubuntu releases security updates for Tornado web server vulnerabilities

> **Key takeaway:** Multiple vulnerabilities in the Tornado Python web framework could allow attackers to cause denial of service, expose sensitive data, or bypass access controls.

**Published:** 2026-10-22T12:07:23+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-releases-security-updates-for-tornado-web-server-vuln.html 

## Summary
Ubuntu has issued security updates for the python3-tornado package to address several vulnerabilities. These flaws stem from improper handling of certain HTTP requests and network inputs. The updates affect multiple Ubuntu releases, including 24.04 LTS, 22.04 LTS, and older versions via Ubuntu Pro.

## Vulnerability details
- The vulnerabilities involve improper handling of **HTTP requests** and **network inputs**.
- Potential impacts include **denial of service (DoS)**, **sensitive information exposure**, and **access control bypass**.
- Affected CVEs include: **CVE-2023-54397**, **CVE-2024-14029**, **CVE-2026-91990**, **CVE-2026-91992**, **CVE-2026-103262**, and **CVE-2026-103263**.
- Fixed versions vary by release: **6.5.5-5ubuntu1.1** for 26.10, **6.5.4-0.1ubuntu0.2** for 26.04 LTS, and **6.4.0-1ubuntu0.6** for 24.04 LTS.

## Why it matters
Users running Tornado-based web services on Ubuntu should update their packages immediately to prevent potential exploitation.