ALAS2027-2026-183

References: CVE-2026-91990  CVE-2026-103262  CVE-2026-103263  CVE-2026-103261 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Package updates are available for Amazon Linux 2027 that fix the following vulnerabilities:
CVE-2026-91990:
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.

CVE-2026-103263:
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.

CVE-2026-103262:
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.

CVE-2026-103261:
Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts to degrade response times for all clients sharing the same IOLoop.

Issue Correction:
Run dnf update python-tornado or dnf update --advisory ALAS2027-2026-183 to update your system.

New Packages:

aarch64:
    python-tornado-debugsource-6.5.10-1.amzn2027.0.1.aarch64
    python-tornado-doc-6.5.10-1.amzn2027.0.1.aarch64
    python3-tornado-debuginfo-6.5.10-1.amzn2027.0.1.aarch64
    python3-tornado-6.5.10-1.amzn2027.0.1.aarch64

src:
    python-tornado-6.5.10-1.amzn2027.0.1.src

x86_64:
    python-tornado-doc-6.5.10-1.amzn2027.0.1.x86_64
    python-tornado-debugsource-6.5.10-1.amzn2027.0.1.x86_64
    python3-tornado-debuginfo-6.5.10-1.amzn2027.0.1.x86_64
    python3-tornado-6.5.10-1.amzn2027.0.1.x86_64