CVE-2026-115927 Details

A denial-of-service vulnerability has been identified in Tornado, a Python web framework, in versions prior to 6.6.0. The issue arises when Tornado processes HTTP/1.1 chunked transfer encoding. Instead of yielding control to the event loop, Tornado decodes the body data all at once. This allows a remote, unauthenticated peer to send millions of one-byte chunks, effectively blocking the event loop and stalling other connections for an extended period. Additionally, the vulnerability leads to excessive memory consumption, as each tiny chunk is stored as a separate object, using roughly twenty times the actual body size. The problem is exacerbated in the 'SimpleAsyncHTTPClient' when reading responses from a malicious server.

Users can update to Tornado version 6.6.0 or later, where this vulnerability is fixed. For those unable to upgrade, running Tornado behind a reverse proxy that buffers request bodies and forwards them with a 'Content-Length' header can help mitigate the issue. Additionally, lowering the 'max_body_size' limit can reduce the impact of each individual request.