CVE-2026-103262 Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient
Remote attackers can cause denial of service in Tornado applications by sending gzip-encoded decompression bombs that exhaust memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-103262?
CVE-2026-103262 is a high-severity denial of service vulnerability in tornadoweb tornado, published on 1 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.
Weakness: CWE-409
Which versions are affected by CVE-2026-103262?
2 open source packages ship an affected version, including tornado.
| Package | Affected | Fixed in |
|---|---|---|
tornado PyPI | All versions | 6.5.9 |
tornado PyPI | All versions | 6.5.9 |
Linux distribution packages (12)
python3-tornado AlmaLinux:10 | All versions | 6.5.10-1.el10_2.1 |
python3-tornado AlmaLinux:9 | All versions | 6.5.10-1.el9_8.1 |
python-tornado Red Hat:enterprise_linux:10.2 | All versions | 0:6.5.10-1.el10_2.1 |
python-tornado-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:6.5.10-1.el10_2.1 |
python3-tornado Red Hat:enterprise_linux:10.2 | All versions | 0:6.5.10-1.el10_2.1 |
python3-tornado-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:6.5.10-1.el10_2.1 |
python-tornado Red Hat:enterprise_linux:9::appstream | All versions | 0:6.5.10-1.el9_8.1 |
python-tornado-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:6.5.10-1.el9_8.1 |
python3-tornado Red Hat:enterprise_linux:9::appstream | All versions | 0:6.5.10-1.el9_8.1 |
python3-tornado-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:6.5.10-1.el9_8.1 |
python-tornado Rocky Linux:10 | All versions | 0:6.5.10-1.el10_2.1 |
python-tornado Rocky Linux:9 | All versions | 0:6.5.10-1.el9_8.1 |
How do I fix CVE-2026-103262?
Upgrade tornado to 6.5.9 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-103262 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-103262 exists.
Sources
Also known as ALSA-2026:82040, ALSA-2026:82041, AZL-105378, BELL-CVE-2026-103262, CLEANSTART-2026-IF03727, CLSA-2026-1790836708 and 32 more.