diff --git a/pcs.spec b/pcs.spec
index 213458aaa5a5d3c18bb5cd1013e7b615325e3fea..4882a36cda93d393f82643d17603a302f37fda0d 100644
--- a/pcs.spec
+++ b/pcs.spec
@@ -2,7 +2,7 @@
 %global ui_modules_version 0.1.16
 %global ui_src_name pcs-web-ui-%{ui_commit}
 %global pyagentx_version   0.4.pcs.2
-%global tornado_version    6.2.0
+%global tornado_version    6.3.3
 %global dacite_version  1.6.0
 %global version_rubygem_backports  3.23.0
 %global version_rubygem_childprocess  4.1.0
@@ -34,7 +34,7 @@
 Summary: Pacemaker Configuration System
 Name:    pcs
 Version: 0.11.5
-Release: 23%{?dist}
+Release: 24%{?dist}
 License: GPL-2.0-only AND Apache-2.0 AND MIT AND BSD-3-Clause AND (GPL-2.0-only OR Ruby) AND BSD-2-Clause AND (BSD-2-Clause OR Ruby)
 URL:     https://github.com/ClusterLabs/pcs
 
@@ -301,6 +301,10 @@ pcsd/test/test_all_suite.rb \
 %{_mandir}/man8/pcs_snmp_agent.*
 
 %changelog
+* Thu Sep 17 2026 PkgAgent Robot <pkgagent@opencloudos.tech> - 0.11.5-24
+- [Type] security
+- [DESC] Update bundled tornado to 6.3.3 (fixes CVE-2023-54397 HTTP request smuggling via lax Content-Length parsing)
+
 * Sun Aug 02 2026 PkgAgent Robot <pkgagent@opencloudos.tech> - 0.11.5-23
 - [Type] security
 - [DESC] Update bundled puma to 7.2.1 (fixes CVE-2026-47736, CVE-2026-47737 PROXY protocol v1)
diff --git a/sources b/sources
index c85e1032c8590e1a213144843470ab46905421d2..bba9277265fec6d568eafcc29023e2e8d52f0642 100644
--- a/sources
+++ b/sources
@@ -1,6 +1,6 @@
 SHA512 (v0.11.5.tar.gz) = 4ecc9b0301c1edaf555dba6029c0bddb287c0541904bcfd4e518e882f55e07d86f9aa17ef9f28b646a084db43e461744bc41b3d5f986a4206b7f0f3e5628448d
 SHA512 (pyagentx-0.4.pcs.2.tar.gz) = d4194fec9a3e5fefe3793d49b7fec1feafef294c7e613a06046c2993daeefc5cb39d7c5b2b402ff83e49b2d976953f862264288c758c0be09d997b5323cc558a
-SHA512 (tornado-6.2.0.tar.gz) = b8f98b76198f21bb3a13f44e8698397d7906a415e75621550dfeea8ae3a7e9405f5e314136a93b6714455062501051c145dfd32c71b433715fc8ed591fcb882b
+SHA512 (tornado-6.3.3.tar.gz) = d4813de111139da2f5bd390bdd8d456797a48ba2ebe730946aabd66d9269ce4425d9b70ce62aa443ea5590d667b9056766841d99dcb0f383b2c9acd409474c8d
 SHA512 (dacite-1.6.0.tar.gz) = 034255f095589d309fe5805413d8b148f430cd20a0de305b7954083b530d516da1d8f3f00ebb5264a8cfb77f2b2a76f1e2d863e78bd191f1d85021c5553815da
 SHA512 (backports-3.23.0.gem) = b6d721a2925a932e451437938e01c6e3f4ac08bafac975063963f7866e17015abfeb6862face89cbd08caf479db75eb085f540263ba251a87c6acc7611ba6d40
 SHA512 (ethon-0.16.0.gem) = 3b31affcee0d5a5be05b5497d4a8d13515f8393f54579a3a9c8de49f78d3f065bb92659434b023f0a8bf8e0cccfbc94b617695b93c4d3f744cccd1eff2e68905