{"schema":"threatline.record/2","record":{"id":"CVE-2026-115927","aliases":["GHSA-r4j5-9xpp-3985"],"summary":"Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks","details":"Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.","categories":["Unclassified"],"product":"tornado","vendor":"tornadoweb","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115927","source_modified_at":"2026-10-26T19:37:40.584Z","fetched_at":"2026-10-26T23:45:56.352924Z","product":"tornado","vendor":"tornadoweb","versions":[{"version":"< 6.6.0","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-26T19:37:40.584Z","modified_at":"2026-10-26T19:37:40.584Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-115927","fetched_at":"2026-10-26T23:45:56.352924Z","source_modified_at":"2026-10-26T19:37:40.584Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-r4j5-9xpp-3985","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/tornadoweb/tornado/pull/3773","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/tornadoweb/tornado/commit/ceab33581489751a66fba8566ad6d5960d4b01c8","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/tornadoweb/tornado/releases/tag/v6.6.0","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-26T19:37:40.584Z","content_hash":"9a9ecf2ce0d2d150d3957e7953ba47ed9dc45429bf73becd1444878ac5959b62"}}