The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-556:01 advisory.

    * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)
      * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments     (CVE-2026-35536)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:20572 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

    * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments     (CVE-2026-35536)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0339 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-35536:
    In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite     arguments to .RequestHandler.set_cookie were not checked for crafted characters.

    CVE-2026-31958:
    Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to     6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default     100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-     service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is     fixed in 6.5.5.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:24342 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

    * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments     (CVE-2026-35536)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-672e8e4169 advisory.

    Automatic update for python-tornado-6.5.7-1.fc45.

    ##### **Changelog**

    ```
    * Mon Jun 22 2026 Peter Robinson <pbrobinson@gmail.com> - 6.5.7-1
    - Update to 6.5.7 - CVE-2026-35536 (rhbz#2457335), CVE-2026-31958       (rhbz#2451660)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-19034 advisory.

    [6.5.5-1]
    - Update to 6.5.5       Resolves: RHEL-160935

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_19034 advisory.

    * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

    * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments     (CVE-2026-35536)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_19189 advisory.

    * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

    * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments     (CVE-2026-35536)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
312848	MiracleLinux 9 : python-tornado-6.5.5-1.el9_7.1 (AXSA:2026-556:01)	Nessus	Miracle Linux Local Security Checks	2026/5/7	2026/5/21	high
316751	RHEL 9 : python-tornado (RHSA-2026:20572)	Nessus	Red Hat Local Security Checks	2026/5/26	2026/5/26	high
318554	TencentOS Server 4: python-tornado (TSSA-2026:0339)	Nessus	Tencent Local Security Checks	2026/6/3	2026/6/3	high
319651	RHEL 7 : python-tornado (RHSA-2026:24342)	Nessus	Red Hat Local Security Checks	2026/6/8	2026/6/8	high
325022	Fedora 45 : python-tornado (2026-672e8e4169)	Nessus	Fedora Local Security Checks	2026/7/3	2026/7/3	high
327015	Oracle Linux 10 : python-tornado (ELSA-2026-19034)	Nessus	Oracle Linux Local Security Checks	2026/7/15	2026/7/15	high
355242	Rocky Linux 10.1 [CIQ] Security Update: python-tornado-debugsource / python3-tornado / etc Multiple Vulnerabilities (crlsa-2026_19034)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
355978	Rocky Linux 9 [CIQ] Security Update: python-tornado-debugsource / python3-tornado / etc Multiple Vulnerabilities (crlsa-2026_19189)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high

検出

プラグインの検索

high

high

high

high

high

high

high

high