Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
python-tornado may crash when handling compressed data
published 1 month ago
Summary
The python-tornado library (versions before 6.5.9) can run out of memory if it receives a specially crafted gzip-compressed response. This can cause the application using Tornado to stop working. Update Tornado to version 6.5.9 or later to prevent the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | python-tornado | <= 6.3.3-11 |
Original advisory text
CVE-2026-103262 affecting package python-tornado 6.3.3-11
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.
References
Timeline
Published1 Oct 2026
Updated3 Oct 2026
First seen3 Oct 2026
Sources
AZL-105378 · OSV
Track software like this
Free during beta