Live › vulnerability › CVE-2026-115927
Go to dashboardTornado decodes HTTP/1.1 chunked bodies without yielding to the event loop, so a remote peer sending millions of one-byte chunks blocks every other connection in that process. For handlers that do not use @stream_request_body, each chunk is kept as a separate object, using roughly twenty times the body size in memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 20:50 UTC. All times on this page are UTC.
Applications running Tornado below 6.6.0 that accept request bodies from untrusted clients, or fetch responses from untrusted servers with SimpleAsyncHTTPClient. Exposure is highest for handlers that read the full body without @stream_request_body. Services behind a proxy that rejects chunked bodies or that only handle trusted internal traffic are less exposed.
No product ranges from the sources yet.
pip show tornado or python -c "import tornado; print(tornado.version)" to read the installed version@stream_request_body and whether the app runs SimpleAsyncHTTPClient against untrusted servers6.6.0 or latermax_body_size only as a partial mitigation, since it limits duration but not the stallEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-115927")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.