CVE-2026-49855
highpriority · track · 0EPSS 0.006 · 48 %ileDEEUUSEPSS · scored 2026-10-21
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer configured with decompress_request=True to consume effectively unlimited memory. This issue is fixed in version 6.5.6.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (6)
Products and version ranges known to be affected.
- Red Hat Enterprise Linux tornadoall versionscert_bundDEcpe:/o:redhat:enterprise_linux:python-tornado__6.4.2
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-3870Red Hat Enterprise Linux (python-tornado): Mehrere SchwachstellenDeutsch2026-10-11csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in python-tornado in Red Hat Enterprise Linux ausnutzen, um Informationen offenzulegen oder einen Denial of Service zu verursachen
- GHSA-mgf9-4vpg-hj56tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)2026-06-15ghsa · osvUS
Tornado's gzip decompression routines work in limited-size chunks, but have no overall limit for the total size of decompressed chunks that they will accumulate (There has always been a limit for the total *compressed* size). This allows a malicious server to consume effectively unlimited amounts of memory if it is accessed via SimpleAsyncHTTPClient in its default configuration. `HTTPServer` is not affected in its default configuration, but it is if `decompress_request=True` is set. This bug is fixed in Tornado 6.5.6. `max_body_size` is now checked both for the compressed and cumulative decompressed size of the response. Prior to upgrading, this issue can be mitigated by setting `decompress_response=False` or using `CurlAsyncHTTPClient`.
- PYSEC-2026-3389tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)2026-07-13vendor · osvUS
Tornado's gzip decompression routines work in limited-size chunks, but have no overall limit for the total size of decompressed chunks that they will accumulate (There has always been a limit for the total *compressed* size). This allows a malicious server to consume effectively unlimited amounts of memory if it is accessed via SimpleAsyncHTTPClient in its default configuration. `HTTPServer` is not affected in its default configuration, but it is if `decompress_request=True` is set. This bug is fixed in Tornado 6.5.6. `max_body_size` is now checked both for the compressed and cumulative decompressed size of the response. Prior to upgrading, this issue can be mitigated by setting `decompress_response=False` or using `CurlAsyncHTTPClient`.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://github.com/tornadoweb/tornado/commit/ff808b33adc52d89a549376a5e3628e92abbc8ffcnnvd
- https://github.com/tornadoweb/tornado/pull/3626cnnvd
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-mgf9-4vpg-hj56cnnvd
- https://www.tornadoweb.org/Patchcnnvd
- https://github.com/tornadoweb/tornado/commit/ff808b33adc52d89a549376a5e3628e92abbc8ffenisa_euvd
- https://github.com/tornadoweb/tornado/pull/3626enisa_euvd
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-mgf9-4vpg-hj56enisa_euvd
- https://github.com/tornadoweb/tornado/commit/ff808b33adc52d89a549376a5e3628e92abbc8ffnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan