CVE-2026-103262 in Tornado
Summary
by MITRE • 10/01/2026
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The Tornado web framework, prior to version 6.5.9, contains a critical unbounded memory accumulation vulnerability within its CurlAsyncHTTPClient component. This flaw specifically affects how the library handles compressed HTTP responses when utilizing libcurl as the underlying transport mechanism. The core technical deficiency lies in the absence of strict size limits or validation checks during the decompression process for gzip-encoded payloads. When an attacker sends a response that is heavily compressed, such as a gzip bomb designed to expand significantly upon decompression, Tornado allocates memory buffers proportional to the uncompressed data without verifying if this allocation exceeds safe operational thresholds. This lack of boundary checking allows maliciously crafted responses to consume excessive amounts of system RAM, leading directly to resource exhaustion and service disruption.
From an operational perspective, this vulnerability enables a remote denial-of-service attack with minimal effort from the adversary. By simply sending a single or series of compressed HTTP responses containing high-ratio compression artifacts, an attacker can trigger rapid memory growth within the Tornado application process. As the decompressed data accumulates in memory without limit, the operating system eventually terminates the process due to out-of-memory conditions. This results in immediate service unavailability for users relying on the affected Tornado instance. The impact is particularly severe because it requires no authentication or complex exploitation chains; a simple HTTP request with specific headers and payload structure is sufficient to trigger the memory leak behavior, making it an attractive vector for automated attacks targeting public-facing web services built on this framework.
This vulnerability aligns closely with CWE-400, which describes uncontrolled resource consumption, specifically manifesting as excessive allocation of volatile resources like RAM. It also relates to CWE-789, the general category of memory leaks that occur when allocated memory is not properly released or bounded during processing operations. In terms of offensive security frameworks, this attack vector corresponds to MITRE ATT&CK technique T1499, Endpoint Denial of Service, where an adversary degrades system availability by exhausting resources such as CPU, disk space, or memory. The specific mechanism here leverages the decompression functionality inherent in handling HTTP content-encoding headers, exploiting a trust assumption that compressed payloads will remain within reasonable size bounds relative to their network transmission footprint.
To mitigate this vulnerability, organizations running Tornado versions earlier than 6.5.9 must upgrade immediately to version 6.5.9 or later, where the developers have implemented proper limits on decompressed response sizes. For environments unable to patch instantly due to dependency constraints, a temporary mitigation involves deploying a reverse proxy such as Nginx or Apache in front of the Tornado application. These proxies can be configured to limit the maximum size of incoming responses before they are forwarded to the backend service, effectively truncating oversized payloads and preventing them from reaching the vulnerable CurlAsyncHTTPClient component. Additionally, monitoring system memory usage for anomalous spikes correlated with HTTP request patterns can help detect active exploitation attempts in real-time while mitigation strategies are being deployed.