https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 29 Oct 2026 17:56:04 +0000 https://db.gcve.eu/vuln/brew-livereload-cve-2026-116578 <p><strong>Affected:</strong> Homebrew: livereload</p> <p>### Summary</p> <p>`tornado.web.RedirectHandler` builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the application&#39;s domain, which can be used in phishing.</p> <p>### Impact</p> <p>Applications are affected if they use `RedirectHandler` with a URL template where a regex capture group can influence the scheme or host of the redirect. This includes:</p> <p>- **A substitution at the start of the path**, for example `(r&#34;/(.*)/target&#34;, RedirectHandler, {&#34;url&#34;: &#34;/{0}/destination&#34;})`. A request to `https://example.com//evil.com/target` redirects to `//evil.com/destination`, a protocol-relative URL pointing to evil.com. Variants using backslashes or encoded characters have the same effect, because browsers treat them as equivalent to `//`. - **A substitution directly after the host**, for example `(r&#34;/old(.*)&#34;, RedirectHandler, {&#34;url&#34;: &#34;https://new.example.com{0}&#34;})`. A request to `/old.evil.com/` or `/old@evil.com/` redirects to evil.com. - **A template that begins with a substitution** (such as `&#34;{0}&#34;`), which can be given an absolute URL.</p> <p>Applications are not affected if their `RedirectHandler` templates use only static URLs, or if every substitution comes after a fixed host and a `/` (for example `&#34;/static/{0}&#34;` or `&#34;https://example.com/{0}&#34;`). Other uses of `RequestHandler.redirect()` are not affected…</p> <p><strong>Affected:</strong> Homebrew: livereload</p> <p>### Summary</p> <p>`tornado.web.RedirectHandler` builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the application&#39;s domain, which can be used in phishing.</p> <p>### Impact</p> <p>Applications are affected if they use `RedirectHandler` with a URL template where a regex capture group can influence the scheme or host of the redirect. This includes:</p> <p>- **A substitution at the start of the path**, for example `(r&#34;/(.*)/target&#34;, RedirectHandler, {&#34;url&#34;: &#34;/{0}/destination&#34;})`. A request to `https://example.com//evil.com/target` redirects to `//evil.com/destination`, a protocol-relative URL pointing to evil.com. Variants using backslashes or encoded characters have the same effect, because browsers treat them as equivalent to `//`. - **A substitution directly after the host**, for example `(r&#34;/old(.*)&#34;, RedirectHandler, {&#34;url&#34;: &#34;https://new.example.com{0}&#34;})`. A request to `/old.evil.com/` or `/old@evil.com/` redirects to evil.com. - **A template that begins with a substitution** (such as `&#34;{0}&#34;`), which can be given an absolute URL.</p> <p>Applications are not affected if their `RedirectHandler` templates use only static URLs, or if every substitution comes after a fixed host and a `/` (for example `&#34;/static/{0}&#34;` or `&#34;https://example.com/{0}&#34;`). Other uses of `RequestHandler.redirect()` are not affected…</p> https://db.gcve.eu/vuln/brew-livereload-cve-2026-116578 https://db.gcve.eu/vuln/fkie_cve-2026-116578 <p>Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application&#39;s domain for phishing. This issue is fixed in version 6.6.</p> <p>Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application&#39;s domain for phishing. This issue is fixed in version 6.6.</p> https://db.gcve.eu/vuln/fkie_cve-2026-116578 https://db.gcve.eu/vuln/ghsa-pw9p-v7r6-gx4p <p><strong>Affected:</strong> PyPI: tornado</p> <p>### Summary</p> <p>`tornado.web.RedirectHandler` builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the application&#39;s domain, which can be used in phishing.</p> <p>### Impact</p> <p>Applications are affected if they use `RedirectHandler` with a URL template where a regex capture group can influence the scheme or host of the redirect. This includes:</p> <p>- **A substitution at the start of the path**, for example `(r&#34;/(.*)/target&#34;, RedirectHandler, {&#34;url&#34;: &#34;/{0}/destination&#34;})`. A request to `https://example.com//evil.com/target` redirects to `//evil.com/destination`, a protocol-relative URL pointing to evil.com. Variants using backslashes or encoded characters have the same effect, because browsers treat them as equivalent to `//`. - **A substitution directly after the host**, for example `(r&#34;/old(.*)&#34;, RedirectHandler, {&#34;url&#34;: &#34;https://new.example.com{0}&#34;})`. A request to `/old.evil.com/` or `/old@evil.com/` redirects to evil.com. - **A template that begins with a substitution** (such as `&#34;{0}&#34;`), which can be given an absolute URL.</p> <p>Applications are not affected if their `RedirectHandler` templates use only static URLs, or if every substitution comes after a fixed host and a `/` (for example `&#34;/static/{0}&#34;` or `&#34;https://example.com/{0}&#34;`). Other uses of `RequestHandler.redirect()` are not affected…</p> <p><strong>Affected:</strong> PyPI: tornado</p> <p>### Summary</p> <p>`tornado.web.RedirectHandler` builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the application&#39;s domain, which can be used in phishing.</p> <p>### Impact</p> <p>Applications are affected if they use `RedirectHandler` with a URL template where a regex capture group can influence the scheme or host of the redirect. This includes:</p> <p>- **A substitution at the start of the path**, for example `(r&#34;/(.*)/target&#34;, RedirectHandler, {&#34;url&#34;: &#34;/{0}/destination&#34;})`. A request to `https://example.com//evil.com/target` redirects to `//evil.com/destination`, a protocol-relative URL pointing to evil.com. Variants using backslashes or encoded characters have the same effect, because browsers treat them as equivalent to `//`. - **A substitution directly after the host**, for example `(r&#34;/old(.*)&#34;, RedirectHandler, {&#34;url&#34;: &#34;https://new.example.com{0}&#34;})`. A request to `/old.evil.com/` or `/old@evil.com/` redirects to evil.com. - **A template that begins with a substitution** (such as `&#34;{0}&#34;`), which can be given an absolute URL.</p> <p>Applications are not affected if their `RedirectHandler` templates use only static URLs, or if every substitution comes after a fixed host and a `/` (for example `&#34;/static/{0}&#34;` or `&#34;https://example.com/{0}&#34;`). Other uses of `RequestHandler.redirect()` are not affected…</p> https://db.gcve.eu/vuln/ghsa-pw9p-v7r6-gx4p https://db.gcve.eu/vuln/ubuntu-cve-2026-116578 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-tornado, Ubuntu:Pro:18.04:LTS: python-tornado, Ubuntu:Pro:20.04:LTS: python-tornado, Ubuntu:Pro:22.04:LTS: python-tornado, Ubuntu:24.04:LTS: python-tornado, Ubuntu:26.10: python-tornado, Ubuntu:26.04:LTS: python-tornado</p> <p>Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application&#39;s domain for phishing. This issue is fixed in version 6.6.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-tornado, Ubuntu:Pro:18.04:LTS: python-tornado, Ubuntu:Pro:20.04:LTS: python-tornado, Ubuntu:Pro:22.04:LTS: python-tornado, Ubuntu:24.04:LTS: python-tornado, Ubuntu:26.10: python-tornado, Ubuntu:26.04:LTS: python-tornado</p> <p>Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application&#39;s domain for phishing. This issue is fixed in version 6.6.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-116578