Vulnerability details
CVE-2026-103262
tornadoweb tornado
Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient
CVSS 4.0
8.7High
Official description
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.7High | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| tornadoweb | tornado | v < 6.5.9 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9 patch
- https://www.vulncheck.com/advisories/tornado-before-6.5.9-denial-of-service-via-curlasynchttpclient third-party-advisory
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp vendor-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-01
- Last updated
- 2026-10-06
- State
- Published
- Assigner (CNA)
- VulnCheck
Exploit prediction (EPSS)
0.62%
Probability of exploitation in 30 days
50.2%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-409Improper Handling of Highly Compressed Data (Data Amplification)