- Severity: LOW
- CVE: CVE-2026-126347
- Ecosystems: pip
- Packages: tornado
### Summary
Due to differences in the way browsers and Python’s `urllib` parse urls, browsers treat a string starting with three or more slashes as a protocol-level redirect, while `urllib` does not. This means that the 6.6.0 fix for the RedirectHandler open redirect (CVE-2026-116578, commit cc75ab0e) is incomplete. Tornado 6.6.1 improves the open-redirect detection to handle this case correctly, as well as fixing a regression in the 6.6.0 implementation.
Source: GitHub Security Advisories · 2026-11-13