python-tornado - Debian Package Tracker

general

source: python-tornado (main)
version: 6.5.5-4
maintainer: Debian Python Team (DMD)
uploaders: Yaroslav Halchenko [DMD] – Julian Taylor [DMD] – Carl Chenet [DMD] – Julien Puydt [DMD]
arch: all any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 6.1.0-1
o-o-sec: 6.1.0-1+deb11u4
oldstable: 6.2.0-3+deb12u4
old-sec: 6.2.0-3+deb12u4
stable: 6.4.2-3+deb13u2
stable-sec: 6.4.2-3+deb13u2
testing: 6.5.5-3
unstable: 6.5.5-4

versioned links

6.1.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.1.0-1+deb11u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.2.0-3+deb12u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.4.2-3+deb13u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.5.5-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.5.5-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

python-tornado-doc
python3-tornado

action needed

A new upstream version is available: 6.5.7 high

A new upstream version 6.5.7 is available, you should consider packaging it.

Created: 2026-06-25 Last update: 2026-06-29 19:03

2 security issues in trixie high

There are 2 open security issues in trixie.

2 important issues:

CVE-2026-31958: Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.
CVE-2026-35536: In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

Created: 2025-12-12 Last update: 2026-06-29 17:31

2 security issues in bookworm high

There are 2 open security issues in bookworm.

2 important issues:

CVE-2026-31958: Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.
CVE-2026-35536: In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

Created: 2025-12-12 Last update: 2026-06-29 17:31

debian/patches: 1 patch with invalid metadata, 2 patches to forward upstream high

Among the 9 debian patches available in version 6.5.5-3 of the package, we noticed the following issues:

1 patch with invalid metadata that ought to be fixed.
2 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2024-09-25 Last update: 2026-06-25 15:31

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2026-06-26 Last update: 2026-06-26 10:49

testing migrations

excuses:
- Migration status for python-tornado (6.5.5-3 to 6.5.5-4): BLOCKED: Maybe temporary, maybe blocked but Britney is missing information (check below)
- Issues preventing migration:
- ∙ ∙ Missing build on riscv64
- ∙ ∙ Autopkgtest deferred on riscv64: missing arch:riscv64 build
- ∙ ∙ Autopkgtest for dask.distributed/2024.12.1+ds-2: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for emacs-websocket/1.15-2: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for ipykernel/7.2.0-1: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered (will not be considered a regression) ♻ (reference ♻)
- ∙ ∙ Autopkgtest for ipyparallel/9.0.2-1: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for jupyter-client/8.8.0-1: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for jupyter-notebook/7.0.0-2: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for jupyter-server/2.17.0-1: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for jupyterlab/4.0.13+ds1+~2.0.1+~cs1.4.4-1: amd64: No tests, superficial or marked flaky ♻ (reference ♻), arm64: No tests, superficial or marked flaky ♻ (reference ♻), i386: Test triggered, loong64: No tests, superficial or marked flaky ♻ (reference ♻), ppc64el: No tests, superficial or marked flaky ♻ (reference ♻), s390x: Test triggered
- ∙ ∙ Autopkgtest for laniakea/0.1.1-5: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: No tests, superficial or marked flaky ♻ (reference ♻), ppc64el: No tests, superficial or marked flaky ♻ (reference ♻), s390x: Test triggered
- ∙ ∙ Autopkgtest for mopidy/3.4.2-8: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for pcs/0.12.2-2: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for pytest-testinfra/10.2.2-1: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for pytest-tornado/0.8.1-5: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for pytest-tornasync/0.6.0.post2-2: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for python-bonsai/1.5.3+ds-1: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for python-bottle/0.13.4-0.1: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻ (reference ♻), i386: Test triggered, loong64: No tests, superficial or marked flaky ♻ (reference ♻), ppc64el: No tests, superficial or marked flaky ♻ (reference ♻), s390x: Test triggered
- ∙ ∙ Autopkgtest for python-httpretty/1.1.4-6: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻ (reference ♻), i386: Test triggered, loong64: No tests, superficial or marked flaky ♻ (reference ♻), ppc64el: No tests, superficial or marked flaky ♻ (reference ♻), s390x: Test triggered
- ∙ ∙ Autopkgtest for python-jaeger-client/4.8.0-4: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for python-livereload/2.7.1-0.1: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for python-opentracing/2.4.0-3: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for python-pika/1.3.2-4: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for python-streamz/0.6.5-2: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for python-tenacity/9.1.4-2: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for python-tornado/6.5.5-4: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for python-webargs/8.7.1-2: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for python-ws4py/0.6.0+dfsg1-2: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻ (reference ♻), i386: Test triggered, loong64: No tests, superficial or marked flaky ♻ (reference ♻), ppc64el: No tests, superficial or marked flaky ♻ (reference ♻), s390x: Test triggered
- ∙ ∙ Autopkgtest for python-wslink/2.5.7-1: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for pyzmq/27.1.0-1: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for satpy/0.60.0-1: amd64: Pass, arm64: Pass, i386: Test triggered (will not be considered a regression) ♻ (reference ♻), loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for terminado/0.18.1-3: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Autopkgtest for vcr.py/8.1.1-3: amd64: Pass, arm64: Pass, i386: Test triggered, loong64: Pass, ppc64el: Pass, s390x: Test triggered
- ∙ ∙ Lintian check waiting for test results - info
- ∙ ∙ Reproducibility check waiting for results on amd64 - info
- ∙ ∙ Reproducibility check waiting for results on arm64 - info
- ∙ ∙ Reproducibility check waiting for results on i386 - info
- ∙ ∙ Too young, only 1 of 5 days old
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/p/python-tornado.html
- ∙ ∙ Reproduced on armhf - info
- Not considered

news

[rss feed]

[2026-06-29] Accepted python-tornado 6.5.5-4 (source) into unstable (Alexandre Detiste)
[2026-06-28] python-tornado 6.5.5-3 MIGRATED to testing (Debian testing watch)
[2026-06-25] Accepted python-tornado 6.5.5-3 (source) into unstable (Alexandre Detiste)
[2026-05-29] python-tornado 6.5.5-2 MIGRATED to testing (Debian testing watch)
[2026-05-14] Accepted python-tornado 6.5.5-2 (source) into unstable (Scott Talbert)
[2026-04-07] python-tornado 6.5.5-1 MIGRATED to testing (Debian testing watch)
[2026-04-06] Accepted python-tornado 6.2.0-3+deb12u4 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2026-04-06] Accepted python-tornado 6.4.2-3+deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2026-04-03] Accepted python-tornado 6.4.2-3+deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Daniel Leidert)
[2026-04-03] Accepted python-tornado 6.4.2-3+deb13u2 (source) into stable-security (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2026-04-03] Accepted python-tornado 6.2.0-3+deb12u4 (source) into oldstable-security (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2026-04-03] Accepted python-tornado 6.2.0-3+deb12u3 (source) into oldstable-security (Debian FTP Masters) (signed by: Daniel Leidert)
[2026-04-01] Accepted python-tornado 6.1.0-1+deb11u4 (source) into oldoldstable-security (Daniel Leidert)
[2026-03-30] Accepted python-tornado 6.5.5-1 (source) into unstable (Daniel Leidert)
[2026-03-10] python-tornado 6.5.4-1 MIGRATED to testing (Debian testing watch)
[2026-03-06] Accepted python-tornado 6.5.4-1 (source) into unstable (Carlos Henrique Lima Melara)
[2026-01-31] Accepted python-tornado 6.1.0-1+deb11u3 (source) into oldoldstable-security (Daniel Leidert)
[2026-01-09] python-tornado 6.5.4-0.1 MIGRATED to testing (Debian testing watch)
[2026-01-07] Accepted python-tornado 6.5.4-0.1 (source) into unstable (Adrian Bunk)
[2025-10-09] python-tornado 6.5.2-3 MIGRATED to testing (Debian testing watch)
[2025-10-05] Accepted python-tornado 6.5.2-3 (source) into unstable (Bo YU)
[2025-09-28] Accepted python-tornado 6.5.2-2 (source) into unstable (Thomas Goirand)
[2025-08-26] Accepted python-tornado 6.5.2-1 (source) into experimental (Thomas Goirand)
[2025-06-06] Accepted python-tornado 6.2.0-3+deb12u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Daniel Leidert)
[2025-06-06] Accepted python-tornado 6.2.0-3+deb12u2 (source) into stable-security (Debian FTP Masters) (signed by: Daniel Leidert)
[2025-05-29] Accepted python-tornado 6.1.0-1+deb11u2 (source) into oldstable-security (Daniel Leidert)
[2025-05-25] python-tornado 6.4.2-3 MIGRATED to testing (Debian testing watch)
[2025-05-22] Accepted python-tornado 6.4.2-3 (source) into unstable (Bo YU)
[2025-05-18] Accepted python-tornado 6.4.2-2 (source) into unstable (Colin Watson)
[2025-01-03] Accepted python-tornado 6.2.0-3+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Daniel Leidert)

bugs [bug history graph]

all: 0

links

homepage
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
l10n (-, 100)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 6.5.5-2