← All notices | Source (USN-8952-1) | Text version

QSN-8952-1: Tornado vulnerabilities

October 22, 2026

Summary

Tornado could be made to crash or expose sensitive information if it received specially crafted network traffic.

Details

It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls.

(CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992, CVE-2026-103262, CVE-2026-103263)

Affected QuantaStor releases

ReleasePlatformPackageExposureShipped versionFixed versionStatus
6.9.1.001Ubuntu 22.04 LTSpython3-tornadoExternally-facing6.1.0-3ubuntu0.1~esm26.1.0-3ubuntu0.1~esm6Fix pending
6.9.0.464Ubuntu 22.04 LTSpython3-tornadoExternally-facing6.1.0-3ubuntu0.1~esm26.1.0-3ubuntu0.1~esm6Fix pending
6.8.6.015Ubuntu 22.04 LTSpython3-tornadoExternally-facing6.1.0-3ubuntu0.1~esm26.1.0-3ubuntu0.1~esm6Fix pending
6.8.5.018Ubuntu 22.04 LTSpython3-tornadoExternally-facing6.1.0-3ubuntu0.1~esm26.1.0-3ubuntu0.1~esm6Fix pending
6.8.4.038Ubuntu 22.04 LTSpython3-tornadoExternally-facing6.1.0-3ubuntu0.1~esm26.1.0-3ubuntu0.1~esm6Fix pending
6.8.3.018Ubuntu 22.04 LTSpython3-tornadoExternally-facing6.1.0-3ubuntu0.1~esm26.1.0-3ubuntu0.1~esm6Fix pending
6.8.2.002Ubuntu 22.04 LTSpython3-tornadoExternally-facing6.1.0-3ubuntu0.1~esm26.1.0-3ubuntu0.1~esm6Fix pending
6.8.1.007Ubuntu 22.04 LTSpython3-tornadoExternally-facing6.1.0-3ubuntu0.1~esm26.1.0-3ubuntu0.1~esm6Fix pending
6.8.0.205Ubuntu 22.04 LTSpython3-tornadoExternally-facing6.1.0-3ubuntu0.1~esm26.1.0-3ubuntu0.1~esm6Fix pending

Internally-facing: only accessible when logged into the QuantaStor console/ssh as the qadmin administrative sudo user; generally lower priority. Externally-facing: part of a service the storage platform presents on the network (or the kernel), so potentially reachable over the network.

CVEs

CVE-2026-103263, CVE-2024-14029, CVE-2023-54397, CVE-2026-91992, CVE-2026-91990, CVE-2026-103262

References

https://ubuntu.com/security/notices/USN-8952-1

https://nvd.nist.gov/vuln/detail/CVE-2026-103263

https://nvd.nist.gov/vuln/detail/CVE-2024-14029

https://nvd.nist.gov/vuln/detail/CVE-2023-54397

https://nvd.nist.gov/vuln/detail/CVE-2026-91992

https://nvd.nist.gov/vuln/detail/CVE-2026-91990

https://nvd.nist.gov/vuln/detail/CVE-2026-103262

Update

Fixes marked Fixed by QuantaStor security update are applied by upgrading QuantaStor with security patches included (Upgrade Manager). Fixed package versions:

PlatformPackageVersion
bionicpython-tornado4.5.3-1ubuntu0.2+esm4
Ubuntu 20.04 LTSpython-tornado6.0.3+really5.1.1-3ubuntu0.1~esm7
Ubuntu 22.04 LTSpython-tornado6.1.0-3ubuntu0.1~esm6
Ubuntu 24.04 LTSpython-tornado6.4.0-1ubuntu0.6
resolutepython-tornado6.5.4-0.1ubuntu0.2
stonkingpython-tornado6.5.5-5ubuntu1.1
xenialpython-tornado4.2.1-1ubuntu3.1+esm4