{"id":"CVE-2026-115927","kind":"vulnerability","aliases":["CVE-2026-115927"],"related":[],"title":"Tornado: chunked request bodies can stall the event loop and exhaust memory","description":"Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.","summary":"Tornado decodes HTTP/1.1 chunked bodies without yielding to the event loop, so a remote peer sending millions of one-byte chunks blocks every other connection in that process. For handlers that do not use @stream_request_body, each chunk is kept as a separate object, using roughly twenty times the body size in memory.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","python","self-hosted","tornado"],"not_affected_if":["no-chunked-input","trusted-clients-only","version-6.6.0-or-later"],"how_to_check":"- `pip show tornado` or `python -c \"import tornado; print(tornado.version)\"` to read the installed version\n- Check whether any handler uses `@stream_request_body` and whether the app runs `SimpleAsyncHTTPClient` against untrusted servers","fix":"- Upgrade Tornado to `6.6.0` or later\n- Until upgraded, lower `max_body_size` only as a partial mitigation, since it limits duration but not the stall","status":"open","published_at":"2026-10-26T20:17:52+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","triaged_at":"2026-10-26T20:51:54+00:00","updated_at":"2026-10-26T20:51:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T20:51:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Tornado to `6.6.0` or later\n- Until upgraded, lower `max_body_size` only as a partial mitigation, since it limits duration but not the stall","reach":"internet","title":"Tornado: chunked request bodies can stall the event loop and exhaust memory","impact":"medium","summary":"Tornado decodes HTTP/1.1 chunked bodies without yielding to the event loop, so a remote peer sending millions of one-byte chunks blocks every other connection in that process. For handlers that do not use @stream_request_body, each chunk is kept as a separate object, using roughly twenty times the body size in memory.","category":"package","nicknames":[],"who_cares":["python","tornado","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"One peer stalls every connection served by the process and inflates memory","analyst_note":"","how_to_check":"- `pip show tornado` or `python -c \"import tornado; print(tornado.version)\"` to read the installed version\n- Check whether any handler uses `@stream_request_body` and whether the app runs `SimpleAsyncHTTPClient` against untrusted servers","needs_analyst":false,"not_affected_if":["version-6.6.0-or-later","no-chunked-input","trusted-clients-only"],"who_is_affected":"Applications running Tornado below 6.6.0 that accept request bodies from untrusted clients, or fetch responses from untrusted servers with SimpleAsyncHTTPClient. Exposure is highest for handlers that read the full body without @stream_request_body. Services behind a proxy that rejects chunked bodies or that only handle trusted internal traffic are less exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000653,"input_tokens":3438,"output_tokens":619,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115927':15A,18A '-2026':14A,17A '6.6.0':92C,200C 'alreadi':105C 'arriv':106C 'asynchron':87C 'behavior':185C 'block':47B 'bodi':4A,29B,62B,76B,101C,143C,160C,175C 'byte':45B,123C 'chunk':2A,28B,46B,64B,96C,124C,163C 'connect':50B,135C 'consum':169C 'cve':13A,16A 'data':102C 'decod':26B,94C 'durat':148C 'encod':98C 'event':8A,34B,111C,129C,183C 'event-loop':182C 'everi':48B,133C 'exhaust':11A 'fix':197C 'framework':85C 'handler':55B,153C 'host':23B 'http/1.1':27B,95C 'issu':195C 'kept':66B 'librari':89C 'limit':146C 'loop':9A,35B,112C,130C,184C 'lower':141C 'malici':192C 'max':142C 'memori':12A,79B 'million':41B,119C 'monopol':126C 'network':88C 'object':70B,167C 'one':44B,122C 'one-byt':43B,121C 'packag':19B 'peer':39B,116C 'prior':90C 'process':53B,100C,128C,139C 'python':20B,83C 'read':187C 'receiv':174C 'remot':38B,114C 'request':3A,61B,151C,159C 'respons':189C 'retain':161C 'rough':72B,170C 'self':22B 'self-host':21B 'send':40B,118C 'separ':69B,166C 'serv':136C 'server':193C 'simpleasynchttpcli':178C 'size':77B,144C,176C 'stall':6A,132C 'stream':60B,158C 'time':74B,172C 'tornado':1A,24B,25B,80C,93C 'transfer':97C 'twenti':73B,171C 'unauthent':115C 'use':59B,71B,157C 'version':199C 'web':84C 'without':30B,107C 'yield':31B,108C","nicknames":[],"mitigations":[],"who_affected":"Applications running Tornado below 6.6.0 that accept request bodies from untrusted clients, or fetch responses from untrusted servers with SimpleAsyncHTTPClient. Exposure is highest for handlers that read the full body without @stream_request_body. Services behind a proxy that rejects chunked bodies or that only handle trusted internal traffic are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T20:17:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115927","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115927","severity":null,"published_at":"2026-10-26T20:17:52+00:00","modified_at":"2026-10-26T20:17:52+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","fetched_at":"2026-10-26T20:50:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}