CVE-2026-115927

Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

View on CVE.org
Published Oct 26, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.

Analysis

AI-generated

Technical impact

A remote, unauthenticated attacker can send millions of one‑byte HTTP/1.1 chunked transfer encoding pieces. The vulnerable decoder processes already‑arrived body data without yielding control to the event loop, so the process stalls and can no longer service other connections. Additionally, storing each chunk as a separate object can grow memory usage to roughly twenty times the total body size, exhausting resources. The result is a denial of service that can affect the entire Tornado process. The weakness is reflected in CWE‑400 and CWE‑770.

Affected Systems

Any application that uses Tornado versions prior to 6.6.0, including both server and client code such as SimpleAsyncHTTPClient, is impacted. The issue is fixed in Tornado release 6.6.0.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity threat. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so no current evidence of widespread exploitation is reported. The attack vector is likely from a remote network connection, as the vulnerability requires only the ability to send malformed chunked requests. An attacker can exploit this without authentication, provided the application accepts arbitrary HTTP requests.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Tornado to version 6.6.0 or later, which removes the event‑loop blocking and excessive memory consumption issues.
  • If an upgrade is not immediately possible, configure the application to reject or disable HTTP/1.1 chunked transfer encoding for inbound requests, or enforce stricter limits on request size and the number of chunks.
  • Enable monitoring of the event loop and memory usage to detect abnormal blocking or memory spikes, and consider adding application‑level logging or thresholds for suspicious chunked traffic.
  • When using SimpleAsyncHTTPClient, employ the @stream_request_body decorator or migrate to a newer client API that yields control during stream processing.

Generated by OpenCVE AI on October 27, 2026 at 13:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-r4j5-9xpp-3985 Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-1322
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
First Time appeared Tornadoweb
Tornadoweb tornado
Vendors & Products Tornadoweb
Tornadoweb tornado
Type Values Removed Values Added
Description Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.
Title Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
Weaknesses CWE-400
CWE-770
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}
Weaknesses
  • CWE-1322

    Use of Blocking Code in Single-threaded, Non-blocking Context

  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Oct 27, 2026, 2:18 PM
Reserved
Oct 23, 2026, 8:21 PM

View source JSON

Updated
Oct 27, 2026, 1:45 PM

JSON

Status
Deferred
Published
Oct 26, 2026, 8:17 PM
Modified
Oct 27, 2026, 3:16 PM

View source JSON

Severity
Moderate
Public date
Oct 26, 2026, 7:37 PM

View source Bugzilla JSON

Updated
Oct 27, 2026, 1:45 PM

JSON