CVE-2026-103262

Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

Description

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.

Scores

Faiblesses (CWE)

• CWE-409

Avis

• GHSA-chx6-46f5-w4vp — tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM

Références européennes

• ENISA EUVD · EUVD-2026-90656
• GCVE · GCVE-0-2026-103262

Produits affectés

Références

• https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp
• https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9
• https://www.vulncheck.com/advisories/tornado-before-6.5.9-denial-of-service-via-curlasynchttpclient

Sources