CVE-2026-103262: Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tornadoto a version that resolves this vulnerability.Fixed in 6.5.9
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Tornado versions before 6.5.9 and the CurlAsyncHTTPClient are exposed when they fetch attacker-controlled or otherwise untrusted HTTP responses.
What does an attacker need to exploit the vulnerability?
An attacker needs to cause the affected client to receive a gzip-encoded decompression bomb. No authentication or user interaction is required, and the attack can be performed remotely.
What is the operational impact?
The compressed response can expand without memory limits in CurlAsyncHTTPClient, accumulating until the application process is terminated by out-of-memory conditions. The described impact is denial of service; no confidentiality or integrity impact is indicated.
How can I determine whether an application is affected?
Check whether the application runs a Tornado release earlier than 6.5.9 and uses CurlAsyncHTTPClient. Also identify outbound requests that may retrieve compressed responses from sources an attacker can influence.