CVE-2026-49855: tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer configured with decompressrequest=True to consume effectively unlimited memory. This issue is fixed in version 6.5.6.
Other sources
Tornado's gzip decompression routines work in limited-size chunks, but have no overall limit for the total size of decompressed chunks that they will accumulate (There has always been a limit for the total compressed size). This allows a malicious server to consume effectively unlimited amounts of memory if it is accessed via SimpleAsyncHTTPClient in its default configuration. HTTPServer is not affected in its default configuration, but it is if decompressrequest=True is set.
This bug is fixed in Tornado 6.5.6. maxbodysize is now checked both for the compressed and cumulative decompressed size of the response.
Prior to upgrading, this issue can be mitigated by setting decompressresponse=False or using CurlAsyncHTTPClient.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/tornadoto a version that resolves this vulnerability.Fixed in 6.5.6 - Upgrade
Upgrade
tornadoto a version that resolves this vulnerability.Fixed in 6.5.6 - Configuration
Mitigate prior to upgrading to 6.5.6 by setting `decompress_response=False`.
Tornado SimpleAsyncHTTPClient decompress_response = False - Configuration
If using `HTTPServer`, ensure `decompress_request` is not set to `True` (set it to `False`) because `HTTPServer` is only affected when `decompress_request=True`.
Tornado HTTPServer decompress_request = False - Compensating control
Mitigate prior to upgrading to 6.5.6 by using `CurlAsyncHTTPClient` instead of `SimpleAsyncHTTPClient`.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49855?
CVE-2026-49855 has a high severity rating of 7.5.
How can I fix CVE-2026-49855?
To fix CVE-2026-49855, you should update to the latest version of Tornado that addresses this vulnerability.
What risks are associated with CVE-2026-49855?
CVE-2026-49855 poses a risk of denial of service due to the unlimited accumulation of decompressed data.
Is CVE-2026-49855 specific to any software?
CVE-2026-49855 specifically affects the Tornado web framework and related packages.
When was CVE-2026-49855 published?
CVE-2026-49855 was published on June 15, 2026.