Tornado is a Python web framework and asynchronous networking library. The vulnerability is an out‑of‑bounds memory read in the optional C extension tornado.speedups. The extension implements websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the supplied buffer when XSRF token decoding is performed with the native extension active. Because the read is unbounded, it may expose adjacent memory contents, allowing an attacker to glean sensitive data. The flaw does not provide direct code execution, so the primary impact is information disclosure.

Any installation of Tornado version 6.5.5 or earlier, including all releases of the Tornado Web framework that include the optional tornado.speedups C extension, is vulnerable. The issue is fixed in Tornado 6.5.6.

The CVSS score of 5.3 places this flaw in the Medium severity range. The EPSS score of less than 1% indicates that exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. The out‑of‑bounds read can be triggered via client requests that invoke XSRF token decoding through the vulnerable C code, but the description does not specify an exact attack vector. Because the flaw only allows a limited memory read, an attacker would need additional context or information to convert it into a more serious attack.