CVE-2026-103262 | BDVDB-2026-381963 Detail

Description#

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-01Record published in the CVE List.
2. Version 22026-10-06Most recent update recorded in the CVE List.