CVE-2026-103262

Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

Published Oct 1, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.

Analysis

Technical impact

Tornado versions earlier than 6.5.9 contain an unbounded memory accumulation flaw in the CurlAsyncHTTPClient component. The client decompresses gzip‑encoded responses without enforcing any size limit. A malicious server can therefore send a decompression bomb that grows the client’s memory usage until the process runs out of memory and crashes. This flaw is classified as an improper limit or range validation weakness (CWE‑409) and results in a loss of availability for the affected service.

Affected Systems

The vulnerability affects any deployment of Tornado that employs the CurlAsyncHTTPClient component and is running a release prior to 6.5.9. This includes all builds derived from source or distributed as binaries, regardless of the host operating system or network exposure.

Risk and Exploitability

The flaw is rated high with a CVSS score of 8.7. Although the EPSS score is not available and the issue is not listed in CISA’s KEV catalog, the attack path is straightforward: a remote attacker sends a crafted HTTP response that contains a gzip‑encoded decompression bomb. No authentication or special privileges are required. The resulting out‑of‑memory condition can be triggered with a single request, making the vulnerability attractive for attackers seeking to disrupt service availability.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

tornadoweb

tornado

unaffected

Version	Status	Constraints
`0`	affected	< 6.5.9
`6.5.9`	unaffected	—

No data.

Vendor Product Versions

Tornadoweb

Tornado

Version	Status	Scheme	Platform
`[0,6.5.9)`	affected	generic	—
`6.5.9`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Tornado to version 6.5.9 or later to eliminate the flaw.
If upgrading is not immediately possible, configure the application to avoid using CurlAsyncHTTPClient for untrusted external traffic or replace it with an HTTP client that imposes a decompression size limit.
Apply system‑level resource limits, such as cgroups or ulimit, or position a reverse proxy to cap memory usage and prevent the process from being terminated by an out‑of‑memory condition.

Generated by OpenCVE AI on October 1, 2026 at 14:45 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8952-1	Tornado vulnerabilities

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.628% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9
https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp
https://nvd.nist.gov/vuln/detail/CVE-2026-103262
https://www.cve.org/CVERecord?id=CVE-2026-103262
https://www.vulncheck.com/advisories/tornado-before-6.5.9-denial-of-service-via-curlasynchttpclient

History

Oct 6, 2026 1:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 2, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-103262 https://www.cve.org/CVERecord?id=CVE-2026-103262
Metrics	threat_severity `None`	threat_severity `Important`

Oct 1, 2026 11:00 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.
Title		Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient
First Time appeared		Tornadoweb Tornadoweb tornado
Weaknesses		CWE-409
CPEs		cpe:2.3:a:tornadoweb:tornado::::::::
Vendors & Products		Tornadoweb Tornadoweb tornado
References		https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9 https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp https://www.vulncheck.com/advisories/tornado-before-6.5.9-denial-of-service-via-curlasynchttpclient
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`