CVE-2026-49855
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
A vulnerability in Tornado before version 6.5.6 allows unlimited decompression of gzip data, potentially leading to memory exhaustion by a malicious server or SimpleAsyncHTTPClient.
Risk Assessment
An attacker can exploit this vulnerability to perform a DoS (denial of service) attack by sending specially crafted gzip data that, when decompressed, consumes all available system memory.
Recommendation
Immediately update the Tornado library to version 6.5.6 or later, which introduces a limit on the total size of decompressed data.
Other vulnerabilities in Tornado
See all- CVE-2026-49854Medium
In Tornado before version 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes. This allows the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active.
- CVE-2026-49853High
In Tornado before version 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.
- CVE-2026-35536High
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.
Original NVD description (English source)
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer configured with decompress_request=True to consume effectively unlimited memory. This issue is fixed in version 6.5.6.