CVE-2026-103262
1 advisory.
PyPI/tornado CVE-2026-103262: high 7.5, EPSS 0.53%
tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
Action: Upgrade tornado to 6.5.9 or later.
pip install tornado==6.5.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.5.9 | - |
Fixed versions
| 6.5.9 |
Sources
- osv: GHSA-chx6-46f5-w4vp
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp
- https://github.com/tornadoweb/tornado/pull/3719
- https://github.com/tornadoweb/tornado/commit/15f056080d8e456f92cca8ad0c33e5a5480414ac
- https://github.com/tornadoweb/tornado/commit/6564e0a0922c16f239d3a18adccd04736e380c89
- https://github.com/tornadoweb/tornado/commit/aa2eb0d989716ac00fe8d7a9919b81c1eccd6ec4
- https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9
- https://github.com/tornadoweb/tornado
- https://github.com/tornadoweb/tornado/releases/tag/v6.5.9
CVE-2026-103262 · published · modified · JSON