RLSA-2026:98080: Important: python-tornado security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient (CVE-2026-103262)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/python3-tornadoto a version that resolves this vulnerability.Fixed in 0:6.5.10-1.el10_3 - Upgrade
Upgrade
rocky-linux/python3-tornado-debuginfoto a version that resolves this vulnerability.Fixed in 0:6.5.10-1.el10_3 - Upgrade
Upgrade
rocky-linux/python-tornado-debugsourceto a version that resolves this vulnerability.Fixed in 0:6.5.10-1.el10_3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Tornado's CurlAsyncHTTPClient are the affected scope identified in the advisory. The issue is a denial of service caused by a decompression bomb.
Does an attacker need credentials or user interaction to exploit it?
No. The listed CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the expected impact of successful exploitation?
Successful exploitation can cause a denial of service. The CVSS vector lists availability impact as high, with no confidentiality or integrity impact.
Which Rocky Linux packages are covered by the update?
The advisory lists python3-tornado, python3-tornado-debuginfo, and python-tornado-debugsource.