Red Hat Product Errata RHSA-2026:19034 - Security Advisory Issued: 2026-05-19 Updated: 2026-05-19 RHSA-2026:19034 - Security Advisory Overview Updated Packages Synopsis Moderate: python-tornado security update Type/Severity Security Advisory: Moderate Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for python-tornado is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958) tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 10 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64 Red Hat Enterprise Linux for IBM z Systems 10 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x Red Hat Enterprise Linux for Power, little endian 10 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat Enterprise Linux for ARM 64 10 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x Fixes BZ - 2446765 - CVE-2026-31958 tornado-python: Tornado: Denial of Service via large multipart bodies BZ - 2454716 - CVE-2026-35536 tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments CVEs CVE-2026-31958 CVE-2026-35536 References https://access.redhat.com/security/updates/classification/#moderate Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 10 SRPM python-tornado-6.5.5-1.el10_2.src.rpm SHA-256: 1fad3cf20e19c863391a069e09f321a9877fecf486a16031360cefc120f998d5 x86_64 python-tornado-debugsource-6.5.5-1.el10_2.x86_64.rpm SHA-256: b82f608efb973337f47d8040307f4115838424cec0a73e342108d502d4c50bfc python3-tornado-6.5.5-1.el10_2.x86_64.rpm SHA-256: 45ef3f2dbe8c148ddad2d2414603fcd0cf0a1029f14cf1e7f4f73037d33ff067 python3-tornado-debuginfo-6.5.5-1.el10_2.x86_64.rpm SHA-256: f8d7770d926a3dc77213d3a848dd79bf8b3ef9ad98646057726db966d3583226 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 SRPM python-tornado-6.5.5-1.el10_2.src.rpm SHA-256: 1fad3cf20e19c863391a069e09f321a9877fecf486a16031360cefc120f998d5 x86_64 python-tornado-debugsource-6.5.5-1.el10_2.x86_64.rpm SHA-256: b82f608efb973337f47d8040307f4115838424cec0a73e342108d502d4c50bfc python3-tornado-6.5.5-1.el10_2.x86_64.rpm SHA-256: 45ef3f2dbe8c148ddad2d2414603fcd0cf0a1029f14cf1e7f4f73037d33ff067 python3-tornado-debuginfo-6.5.5-1.el10_2.x86_64.rpm SHA-256: f8d7770d926a3dc77213d3a848dd79bf8b3ef9ad98646057726db966d3583226 Red Hat Enterprise Linux for IBM z Systems 10 SRPM python-tornado-6.5.5-1.el10_2.src.rpm SHA-256: 1fad3cf20e19c863391a069e09f321a9877fecf486a16031360cefc120f998d5 s390x python-tornado-debugsource-6.5.5-1.el10_2.s390x.rpm SHA-256: 572f90d437d54f2c0a8a66d20866e72e2f0689eed1d2c0d6ce526dca426388e4 python3-tornado-6.5.5-1.el10_2.s390x.rpm SHA-256: a9fb0d2a68239cd1dbb9560ef74d07d5baa79a2a4f1e21f45dc211acf2604791 python3-tornado-debuginfo-6.5.5-1.el10_2.s390x.rpm SHA-256: 9ba82622888d4929ca8921e7466383da45a2cf1e3b3e132a1d4ad2131035ffe1 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 SRPM python-tornado-6.5.5-1.el10_2.src.rpm SHA-256: 1fad3cf20e19c863391a069e09f321a9877fecf486a16031360cefc120f998d5 s390x python-tornado-debugsource-6.5.5-1.el10_2.s390x.rpm SHA-256: 572f90d437d54f2c0a8a66d20866e72e2f0689eed1d2c0d6ce526dca426388e4 python3-tornado-6.5.5-1.el10_2.s390x.rpm SHA-256: a9fb0d2a68239cd1dbb9560ef74d07d5baa79a2a4f1e21f45dc211acf2604791 python3-tornado-debuginfo-6.5.5-1.el10_2.s390x.rpm SHA-256: 9ba82622888d4929ca8921e7466383da45a2cf1e3b3e132a1d4ad2131035ffe1 Red Hat Enterprise Linux for Power, little endian 10 SRPM python-tornado-6.5.5-1.el10_2.src.rpm SHA-256: 1fad3cf20e19c863391a069e09f321a9877fecf486a16031360cefc120f998d5 ppc64le python-tornado-debugsource-6.5.5-1.el10_2.ppc64le.rpm SHA-256: 2f6bbc2a7adb50a532192f27332ee9284be7bb0bd0dc452feb5e115046317ced python3-tornado-6.5.5-1.el10_2.ppc64le.rpm SHA-256: 9eb66c507a380482f253da5e2f12c0a77422fd5c22fa6b46a8dabe77fde5a391 python3-tornado-debuginfo-6.5.5-1.el10_2.ppc64le.rpm SHA-256: 33688213e49667c05f385e3e1484b01ff75c797203489d33d567c11ed6377dff Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 SRPM python-tornado-6.5.5-1.el10_2.src.rpm SHA-256: 1fad3cf20e19c863391a069e09f321a9877fecf486a16031360cefc120f998d5 ppc64le python-tornado-debugsource-6.5.5-1.el10_2.ppc64le.rpm SHA-256: 2f6bbc2a7adb50a532192f27332ee9284be7bb0bd0dc452feb5e115046317ced python3-tornado-6.5.5-1.el10_2.ppc64le.rpm SHA-256: 9eb66c507a380482f253da5e2f12c0a77422fd5c22fa6b46a8dabe77fde5a391 python3-tornado-debuginfo-6.5.5-1.el10_2.ppc64le.rpm SHA-256: 33688213e49667c05f385e3e1484b01ff75c797203489d33d567c11ed6377dff Red Hat Enterprise Linux for ARM 64 10 SRPM python-tornado-6.5.5-1.el10_2.src.rpm SHA-256: 1fad3cf20e19c863391a069e09f321a9877fecf486a16031360cefc120f998d5 aarch64 python-tornado-debugsource-6.5.5-1.el10_2.aarch64.rpm SHA-256: f7ce486683d6b8e0c31b53eb64250bfeb7a375dc3da1f9d9c62783ced4756055 python3-tornado-6.5.5-1.el10_2.aarch64.rpm SHA-256: acd718a3cd7216707e3ce2316493daeb3de854008c7245458ebe6bf6bb22d37c python3-tornado-debuginfo-6.5.5-1.el10_2.aarch64.rpm SHA-256: e254d90cf9baeb3f541db3e6d46f19872eddfa0c783eab6827e64c0e5b063d90 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 SRPM python-tornado-6.5.5-1.el10_2.src.rpm SHA-256: 1fad3cf20e19c863391a069e09f321a9877fecf486a16031360cefc120f998d5 aarch64 python-tornado-debugsource-6.5.5-1.el10_2.aarch64.rpm SHA-256: f7ce486683d6b8e0c31b53eb64250bfeb7a375dc3da1f9d9c62783ced4756055 python3-tornado-6.5.5-1.el10_2.aarch64.rpm SHA-256: acd718a3cd7216707e3ce2316493daeb3de854008c7245458ebe6bf6bb22d37c python3-tornado-debuginfo-6.5.5-1.el10_2.aarch64.rpm SHA-256: e254d90cf9baeb3f541db3e6d46f19872eddfa0c783eab6827e64c0e5b063d90 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 SRPM python-tornado-6.5.5-1.el10_2.src.rpm SHA-256: 1fad3cf20e19c863391a069e09f321a9877fecf486a16031360cefc120f998d5 aarch64 python-tornado-debugsource-6.5.5-1.el10_2.aarch64.rpm SHA-256: f7ce486683d6b8e0c31b53eb64250bfeb7a375dc3da1f9d9c62783ced4756055 python3-tornado-6.5.5-1.el10_2.aarch64.rpm SHA-256: acd718a3cd7216707e3ce2316493daeb3de854008c7245458ebe6bf6bb22d37c python3-tornado-debuginfo-6.5.5-1.el10_2.aarch64.rpm SHA-256: e254d90cf9baeb3f541db3e6d46f19872eddfa0c783eab6827e64c0e5b063d90 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 SRPM python-tornado-6.5.5-1.el10_2.src.rpm SHA-256: 1fad3cf20e19c863391a069e09f321a9877fecf486a16031360cefc120f998d5 s390x python-tornado-debugsource-6.5.5-1.el10_2.s390x.rpm SHA-256: 572f90d437d54f2c0a8a66d20866e72e2f0689eed1d2c0d6ce526dca426388e4 python3-tornado-6.5.5-1.el10_2.s390x.rpm SHA-256: a9fb0d2a68239cd1dbb9560ef74d07d5baa79a2a4f1e21f45dc211acf2604791 python3-tornado-debuginfo-6.5.5-1.el10_2.s390x.rpm SHA-256: 9ba82622888d4929ca8921e7466383da45a2cf1e3b3e132a1d4ad2131035ffe1 Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 SRPM python-tornado-6.5.5-1.el10_2.src.rpm SHA-256: 1fad3cf20e19c863391a069e09f321a9877fecf486a16031360cefc120f998d5 ppc64le python-tornado-debugsource-6.5.5-1.el10_2.ppc64le.rpm SHA-256: 2f6bbc2a7adb50a532192f27332ee9284be7bb0bd0dc452feb5e115046317ced python3-tornado-6.5.5-1.el10_2.ppc64le.rpm SHA-256: 9eb66c507a380482f253da5e2f12c0a77422fd5c22fa6b46a8dabe77fde5a391 python3-tornado-debuginfo-6.5.5-1.el10_2.ppc64le.rpm SHA-256: 33688213e49667c05f385e3e1484b01ff75c797203489d33d567c11ed6377dff Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 SRPM python-tornado-6.5.5-1.el10_2.src.rpm SHA-256: 1fad3cf20e19c863391a069e09f321a9877fecf486a16031360cefc120f998d5 x86_64 python-tornado-debugsource-6.5.5-1.el10_2.x86_64.rpm SHA-256: b82f608efb973337f47d8040307f4115838424cec0a73e342108d502d4c50bfc python3-tornado-6.5.5-1.el10_2.x86_64.rpm SHA-256: 45ef3f2dbe8c148ddad2d2414603fcd0cf0a1029f14cf1e7f4f73037d33ff067 python3-tornado-debuginfo-6.5.5-1.el10_2.x86_64.rpm SHA-256: f8d7770d926a3dc77213d3a848dd79bf8b3ef9ad98646057726db966d3583226 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 SRPM python-tornado-6.5.5-1.el10_2.src.rpm SHA-256: 1fad3cf20e19c863391a069e09f321a9877fecf486a16031360cefc120f998d5 x86