CVE-2026-115927: Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering maxbodysize only limits the duration of each request. For handlers that do not use @streamrequestbody, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tornadoto a version that resolves this vulnerability.Fixed in 6.6.0
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
Any Tornado deployment prior to 6.6.0 that accepts HTTP/1.1 chunked request bodies may be affected by an unauthenticated remote peer. SimpleAsyncHTTPClient is also affected when it reads a response from a malicious server.
What does an attacker need to send to trigger the issue?
The attacker can send a chunked HTTP/1.1 body containing millions of very small, such as one-byte, chunks. No authentication or user interaction is required.
Does reducing max_body_size mitigate the problem?
No. Lowering max_body_size limits the duration of an individual request, but does not prevent the request from monopolizing the process event loop while already-arrived chunk data is processed.
When is memory consumption especially significant?
Handlers that do not use @stream_request_body retain each chunk as a separate object. In that case, memory usage can reach roughly twenty times the received body size.
What version resolves the issue?
Upgrade Tornado to version 6.6.0, which fixes the chunk-processing behavior.