{"schema":"threatline.record/2","record":{"id":"CVE-2026-103262","aliases":["GHSA-chx6-46f5-w4vp"],"summary":"Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient","details":"Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.","categories":["Libraries & packages"],"product":"tornado","vendor":"tornadoweb","ecosystem":"PyPI","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103262","source_modified_at":"2026-10-06T00:08:58.078Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"tornado","vendor":"tornadoweb","versions":[{"version":"0","status":"affected","versionType":"semver","lessThan":"6.5.9"},{"version":"6.5.9","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-chx6-46f5-w4vp","source_modified_at":"2026-10-02T03:56:11.819291984Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"tornado","purl":"pkg:pypi/tornado"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"6.5.9"}],"type":"ECOSYSTEM"}],"versions":["0.2","1.0","1.1","1.1.1","1.2","1.2.1","2.0","2.1","2.1.1","2.2","2.2.1","2.3","2.4","2.4.1","3.0","3.0.1","3.0.2","3.1","3.1.1","3.2","3.2.1","3.2.2","4.0","4.0.1","4.0.2","4.1","4.1b2","4.2","4.2.1","4.2b1","4.3","4.3b1","4.3b2","4.4","4.4.1","4.4.2","4.4.3","4.4b1","4.5","4.5.1","4.5.2","4.5.3","4.5b1","4.5b2","5.0","5.0.1","5.0.2","5.0a1","5.0b1","5.1"]}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103262","source_modified_at":"2026-10-06T00:08:58.078Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"tornado","ecosystem":null},"version":"6.5.9","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-chx6-46f5-w4vp","source_modified_at":"2026-10-02T03:56:11.819291984Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"tornado","purl":"pkg:pypi/tornado"},"version":"6.5.9"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00525,"percentile":0.43708,"score_date":"2026-10-23"},"published_at":"2026-10-01T10:42:04.913Z","modified_at":"2026-10-06T00:08:58.078Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-103262","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-06T00:08:58.078Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-chx6-46f5-w4vp","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-02T03:56:11.819291984Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103262","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9","tags":["patch"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/tornado-before-6.5.9-denial-of-service-via-curlasynchttpclient","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-06T00:08:34.189311Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-06T00:08:58.078Z","content_hash":"36f9957e1aa353afc05b5bcf5abcd169f35bb8fe20a97d827d20521cb335fab6"}}