Technical impact
The Tornado Python web framework and asynchronous networking library, prior to version 6.5.6, processed gzip‑compressed data in limited‑size chunks but did not enforce an overall limit on accumulated decompressed chunks. This flaw allows a malicious server accessed via SimpleAsyncHTTPClient or an HTTPServer configured with decompress_request=True to consume effectively unlimited memory. The issue was addressed in Tornado 6.5.6.
Affected Systems
The vulnerability affects the Tornado Python web framework and asynchronous networking library. All versions prior to 6.5.6 are impacted. Any application that employs SimpleAsyncHTTPClient or an HTTPServer configured with decompress_request=True is susceptible.
Risk and Exploitability
The CVSS score of 7.5 indicates medium‑to‑high severity. The EPSS score of less than 1% indicates a low probability of exploitation at this time, and the issue is not listed in the CISA KEV catalog. An exploitable scenario requires an attacker to control or influence the server that the vulnerable client connects to, or to send a malicious gzip‑compressed request to a server that enables decompression. Once the large payload is processed, the target application can be forced to allocate excessive memory, potentially leading to a crash or an unresponsive state.
Github GHSA