Tornado: Denial of Service in CurlAsyncHTTPClient through unbounded memory growth
Summary
Tornado versions before 6.5.9 do not limit how much data CurlAsyncHTTPClient accumulates from an HTTP response. A malicious server can send a small gzip-compressed response that expands to gigabytes in memory (a decompression bomb). The Tornado process is then killed by the operating system's out-of-memory handler. The attack requires that the application uses CurlAsyncHTTPClient and fetches attacker-influenced URLs. Confidentiality and integrity are not affected.
Affected
- Tornado before 6.5.9 (GHSA lists versions up to and including 6.5.8)
- Only applications that configure CurlAsyncHTTPClient are affected; the default SimpleAsyncHTTPClient is not affected
Fixed in
- Tornado 6.5.9 (upstream fix commit e412435febba4569c552c5c9054f1bf92bd171a9)
- Distribution package versions: Unknown.
Workaround
- Switch the application to the default SimpleAsyncHTTPClient, if no libcurl-specific features such as custom proxy or TLS options are required. This may break services that depend on those features.
- Limit outbound HTTP client requests to trusted destinations and avoid the curl backend for untrusted content.
Exploitation
- Public proof of concept: Yes. The GHSA advisory describes an end-to-end reproduction.
- Exploited in the wild: No known reports found.
- CISA SSVC: Exploitation 'poc', automatable: yes, technical impact: partial.
- EPSS: 0.00525 (low).
Our recommendation
- Inventory Tornado usage, including transitive dependencies, and search the configuration for CurlAsyncHTTPClient.
- If the curl backend is used, upgrade to Tornado 6.5.9 or later, or switch to SimpleAsyncHTTPClient if no libcurl-specific features are needed.
- Check package versions from your Linux distribution (for example RHEL, Oracle Linux, AlmaLinux) because fixed versions there were not confirmed.
- Monitor application memory usage and restarts for signs of out-of-memory kills.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Tornado GHSA-chx6-46f5-w4vp advisory github.com
- Upstream fix commit e412435 github.com
- Tornado pull request 3719 github.com
- VulnCheck advisory www.vulncheck.com
- Red Hat CVE record CVE-2026-103262 access.redhat.com
- Red Hat errata RHSA-2026:82041 access.redhat.com
- OSV CVE-2026-103262 osv.dev
- SUSE CVE listing (Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:22.
Original description (NVD)
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.
NVD references (4)
- https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp
- https://www.vulncheck.com/advisories/tornado-before-6.5.9-denial-of-service-via-curlasynchttpclient
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.