{"action":"Upgrade tornado to 6.5.9 or later.","affected":[{"fixed":"6.5.9","introduced":"0"}],"component":"tornado","cve_ids":["CVE-2026-103262"],"ecosystem":"PyPI","epss":0.00628,"exploited":false,"fixed_versions":["6.5.9"],"ghsa_id":"GHSA-chx6-46f5-w4vp","id":"tcs_01M5KFD5B5ZAZQY77R5HAH42KZ","modified_at":"2026-10-02T03:56:11.819291984Z","published_at":"2026-09-30T23:49:13Z","references":["https://osv.dev/vulnerability/GHSA-chx6-46f5-w4vp","https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp","https://github.com/tornadoweb/tornado/pull/3719","https://github.com/tornadoweb/tornado/commit/15f056080d8e456f92cca8ad0c33e5a5480414ac","https://github.com/tornadoweb/tornado/commit/6564e0a0922c16f239d3a18adccd04736e380c89","https://github.com/tornadoweb/tornado/commit/aa2eb0d989716ac00fe8d7a9919b81c1eccd6ec4","https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9","https://github.com/tornadoweb/tornado","https://github.com/tornadoweb/tornado/releases/tag/v6.5.9"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-chx6-46f5-w4vp","url":"https://osv.dev/vulnerability/GHSA-chx6-46f5-w4vp"}],"summary":"tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM"}