REDHAT-BUG-2544534: High severity Tornado Tornado vulnerability

Q: Which deployments are exposed to this issue?

Applications using Tornado's CurlAsyncHTTPClient on versions before 6.5.9 are exposed when they fetch attacker-controlled or otherwise untrusted HTTP responses.

Q: What does an attacker need to do to trigger the denial of service?

The attacker needs to cause the vulnerable client to receive a gzip-encoded decompression bomb. The decompressed content accumulates in memory without size limits and can lead to the application process being killed by out-of-memory conditions.

Q: How can I determine whether my application is affected?

Check whether the application uses CurlAsyncHTTPClient and whether its Tornado version is earlier than 6.5.9. Also review outbound requests to untrusted endpoints that could return compressed responses.

Published Oct 1, 2026

Updated

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.

Affected Software

1 affected component

Tornado Tornado<6.5.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Tornado to a version that resolves this vulnerability.
Fixed in 6.5.9

Event History

Oct 1, 2026

Data Sourced

via Red Hat·10:57 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications using Tornado's CurlAsyncHTTPClient on versions before 6.5.9 are exposed when they fetch attacker-controlled or otherwise untrusted HTTP responses.

What does an attacker need to do to trigger the denial of service?

The attacker needs to cause the vulnerable client to receive a gzip-encoded decompression bomb. The decompressed content accumulates in memory without size limits and can lead to the application process being killed by out-of-memory conditions.

How can I determine whether my application is affected?

Check whether the application uses CurlAsyncHTTPClient and whether its Tornado version is earlier than 6.5.9. Also review outbound requests to untrusted endpoints that could return compressed responses.

REDHAT-BUG-2544534: High severity Tornado Tornado vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the denial of service?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the denial of service?

How can I determine whether my application is affected?