CVE-2026-49855
highPriorität · verfolgen · 0EPSS 0.006 · 48. PerzentilDEEUUSEPSS · bewertet 2026-10-21
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer configured with decompress_request=True to consume effectively unlimited memory. This issue is fixed in version 6.5.6.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.9–7.5
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (6)
Betroffene Produkte und Versionsbereiche.
- Red Hat Enterprise Linux tornadoalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:python-tornado__6.4.2
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2026-3870Red Hat Enterprise Linux (python-tornado): Mehrere SchwachstellenDeutsch2026-10-11csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in python-tornado in Red Hat Enterprise Linux ausnutzen, um Informationen offenzulegen oder einen Denial of Service zu verursachen
- GHSA-mgf9-4vpg-hj56tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)2026-06-15ghsa · osvUS
Tornado's gzip decompression routines work in limited-size chunks, but have no overall limit for the total size of decompressed chunks that they will accumulate (There has always been a limit for the total *compressed* size). This allows a malicious server to consume effectively unlimited amounts of memory if it is accessed via SimpleAsyncHTTPClient in its default configuration. `HTTPServer` is not affected in its default configuration, but it is if `decompress_request=True` is set. This bug is fixed in Tornado 6.5.6. `max_body_size` is now checked both for the compressed and cumulative decompressed size of the response. Prior to upgrading, this issue can be mitigated by setting `decompress_response=False` or using `CurlAsyncHTTPClient`.
- PYSEC-2026-3389tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)2026-07-13vendor · osvUS
Tornado's gzip decompression routines work in limited-size chunks, but have no overall limit for the total size of decompressed chunks that they will accumulate (There has always been a limit for the total *compressed* size). This allows a malicious server to consume effectively unlimited amounts of memory if it is accessed via SimpleAsyncHTTPClient in its default configuration. `HTTPServer` is not affected in its default configuration, but it is if `decompress_request=True` is set. This bug is fixed in Tornado 6.5.6. `max_body_size` is now checked both for the compressed and cumulative decompressed size of the response. Prior to upgrading, this issue can be mitigated by setting `decompress_response=False` or using `CurlAsyncHTTPClient`.
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (10)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/tornadoweb/tornado/commit/ff808b33adc52d89a549376a5e3628e92abbc8ffcnnvd
- https://github.com/tornadoweb/tornado/pull/3626cnnvd
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-mgf9-4vpg-hj56cnnvd
- https://www.tornadoweb.org/Patchcnnvd
- https://github.com/tornadoweb/tornado/commit/ff808b33adc52d89a549376a5e3628e92abbc8ffenisa_euvd
- https://github.com/tornadoweb/tornado/pull/3626enisa_euvd
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-mgf9-4vpg-hj56enisa_euvd
- https://github.com/tornadoweb/tornado/commit/ff808b33adc52d89a549376a5e3628e92abbc8ffnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan