# Ubuntu releases Tornado update to fix static file serving regression

> **Key takeaway:** A corrective update for the python3-tornado package fixes a regression in USN-8952-1 that broke static file serving for applications like Jupyter.

**Published:** 2026-11-06T15:04:17+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-releases-tornado-update-to-fix-static-file-serving-re.html 

## Summary
Canonical has issued security notice USN-8952-2 to address a regression introduced in a previous Tornado security update. The prior patch, USN-8952-1, attempted to resolve several vulnerabilities but contained an incomplete fix for CVE-2026-103263.

This error specifically impacted applications that subclass Tornado's StaticFileHandler, most notably Jupyter. The regression prevented proper static file serving, which could disrupt the functionality of web-based development environments. The new update restores correct file handling while maintaining the security fixes for the original vulnerabilities.

## Technical details of the Tornado regression
- **Regression Cause:** An incomplete fix for CVE-2026-103263 in the previous update broke the functionality of the StaticFileHandler class.
- **Affected Subsystem:** Applications utilizing Tornado's non-blocking web server that rely on subclassing StaticFileHandler for asset delivery, such as Jupyter, experienced broken static file serving.
- **Security Context:** The update addresses multiple vulnerabilities (CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992, CVE-2026-103262, and CVE-2026-103263) related to improper HTTP request handling that could lead to denial of service, information exposure, or access control bypass.
- **Package Versions:** Fixes are provided across multiple Ubuntu releases, including python3-tornado 6.5.5-5ubuntu1.2 for 26.10 and 6.4.0-1ubuntu0.7 for 24.04 LTS.

## Why it matters
This update is critical for data scientists and developers using Jupyter or similar web-based tools on Ubuntu, as it restores essential interface functionality. It also ensures that the security posture of the Tornado web server is maintained without sacrificing the stability of the application layer.