All vulnerabilities
CVE-2026-103262GHSA-chx6-46f5-w4vp

Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

tornadoweb tornadoPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 6 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.53%Chance of exploitation activity in the next 30 days, higher than 43% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.5.9Fixed versionCVE List
Published1 Oct 2026Updated 6 Oct 2026CVE List

What fixes it

  • 6.5.9tornadoCVE List
  • 6.5.9tornado, PyPIOSVpip install "tornado>=6.5.9"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Vendor and government advisories 1

Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.

Text from CVE List

Affected versions 53

  • tornadoaffected: all versions before 6.5.9CVE List
  • tornadounaffected: 6.5.9CVE List
  • tornado, PyPIfrom first release, fixed in 6.5.9OSV
  • tornado, PyPI0.2OSV
  • tornado, PyPI1.0OSV
  • tornado, PyPI1.1OSV
  • tornado, PyPI1.1.1OSV
  • tornado, PyPI1.2OSV
  • tornado, PyPI1.2.1OSV
  • tornado, PyPI2.0OSV
  • tornado, PyPI2.1OSV
  • tornado, PyPI2.1.1OSV
  • tornado, PyPI2.2OSV
  • tornado, PyPI2.2.1OSV
  • tornado, PyPI2.3OSV
  • tornado, PyPI2.4OSV
  • tornado, PyPI2.4.1OSV
  • tornado, PyPI3.0OSV
  • tornado, PyPI3.0.1OSV
  • tornado, PyPI3.0.2OSV
  • tornado, PyPI3.1OSV
  • tornado, PyPI3.1.1OSV
  • tornado, PyPI3.2OSV
  • tornado, PyPI3.2.1OSV
  • tornado, PyPI3.2.2OSV
  • tornado, PyPI4.0OSV
  • tornado, PyPI4.0.1OSV
  • tornado, PyPI4.0.2OSV
  • tornado, PyPI4.1OSV
  • tornado, PyPI4.1b2OSV
  • tornado, PyPI4.2OSV
  • tornado, PyPI4.2.1OSV
  • tornado, PyPI4.2b1OSV
  • tornado, PyPI4.3OSV
  • tornado, PyPI4.3b1OSV
  • tornado, PyPI4.3b2OSV
  • tornado, PyPI4.4OSV
  • tornado, PyPI4.4.1OSV
  • tornado, PyPI4.4.2OSV
  • tornado, PyPI4.4.3OSV
  • tornado, PyPI4.4b1OSV
  • tornado, PyPI4.5OSV
  • tornado, PyPI4.5.1OSV
  • tornado, PyPI4.5.2OSV
  • tornado, PyPI4.5.3OSV
  • tornado, PyPI4.5b1OSV
  • tornado, PyPI4.5b2OSV
  • tornado, PyPI5.0OSV
  • tornado, PyPI5.0.1OSV
  • tornado, PyPI5.0.2OSV
  • tornado, PyPI5.0a1OSV
  • tornado, PyPI5.0b1OSV
  • tornado, PyPI5.1OSV

References 3