Vulnerability · Published Oct 26, 2026 · Assigned by GitHub_M
CVE-2026-115927Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
Medium 5.3
In plain English
A medium-severity uncontrolled resource consumption in tornado from tornadoweb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-tornado | no fix listed | DEBIAN-CVE-2026-115927 |
| Debian:13 | python-tornado | no fix listed | DEBIAN-CVE-2026-115927 |
| Debian:14 | python-tornado | no fix listed | DEBIAN-CVE-2026-115927 |
| PyPI | tornado | 6.6 | GHSA-r4j5-9xpp-3985 |
| Ubuntu:24.04:LTS | python-tornado | no fix listed | UBUNTU-CVE-2026-115927 |
| Ubuntu:26.04:LTS | python-tornado | no fix listed | UBUNTU-CVE-2026-115927 |
| Ubuntu:26.10 | python-tornado | no fix listed | UBUNTU-CVE-2026-115927 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tornadoweb | tornado | < 6.6.0 |
Weakness: CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-r4j5-9xpp-3985 x_refsource_CONFIRM
- https://github.com/tornadoweb/tornado/pull/3773 x_refsource_MISC
- https://github.com/tornadoweb/tornado/commit/ceab33581489751a66fba8566ad6d5960d4b01c8 x_refsource_MISC
- https://github.com/tornadoweb/tornado/releases/tag/v6.6.0 x_refsource_MISC