{"affected":[{"product":"tornado","source":"CNA: GitHub_M","vendor":"tornadoweb","versions":[{"status":"affected","version":"< 6.6.1"}]}],"cveId":"CVE-2026-126347","cwes":["CWE-601"],"description":"Tornado is a Python web framework and asynchronous networking library. In versions through 6.6.0, applications using  tornado.web.RedirectHandler  with URL templates that allow attacker-controlled substitutions to influence the destination can be vulnerable to an open redirect using three or more leading slashes. Differences between Python’s URL parsing and browser URL interpretation allow a crafted destination to redirect a user to an attacker-controlled host. The remediation for CVE-2026-116578 in version 6.6.0 did not fully address this case. This issue is fixed in version 6.6.1.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":3.1,"severity":"low","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},{"score":3.1,"severity":"low","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1794521959900,"publishedAt":1794520342374,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-5cjw-f85j-cv6r"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tornadoweb/tornado/commit/c503241622c0efe7c40110d89834ce8b7fead1e4"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tornadoweb/tornado/commit/c503241622c0efe7c40110d89834ce8b7fead1e4"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-5cjw-f85j-cv6r"}],"remediation":[],"revision":"1de5f870726b9a4bebabeb7de9ed609e3adb9eea186644f9d2de0a6fa26d1c8c","sources":[{"modifiedAt":1794520342374,"name":"CNA: GitHub_M","retrievedAt":1794522597406,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126347"},{"modifiedAt":1794521959900,"name":"NVD","retrievedAt":1794529644204,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126347"}],"ssvc":null,"status":"published","title":"Tornado: Open redirect via triple-slash redirect paths","updatedAt":1794529644204}