CVE-2026-49855 Details
Description
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer configured with decompress_request=True to consume effectively unlimited memory. This issue is fixed in version 6.5.6.
A vulnerability in Tornado's gzip decompression routines prior to version 6.5.6 allows a malicious server to cause excessive memory consumption. The decompression process, which handles limited-size chunks, lacked an overall limit on the total size of accumulated decompressed data. This issue could be exploited by a server accessed through the SimpleAsyncHTTPClient, or by an HTTPServer configured to decompress requests, leading to effectively unlimited memory usage.
Users can upgrade to Tornado version 6.5.6 or later, where this issue is fixed. In version 6.5.6, the 'max_body_size' parameter is now enforced for both compressed and cumulative decompressed sizes. As a temporary measure, the 'decompress_response' option can be set to false when using the SimpleAsyncHTTPClient, or the 'CurlAsyncHTTPClient' can be used instead.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 14, 2026CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tornadoweb/tornado/commit/ff808b33adc52d89a549376a5e3628e92abbc8ff | [email protected] | Source CodeVendor |
| https://github.com/tornadoweb/tornado/pull/3626 | [email protected] | Issue TrackingVendor |
| https://github.com/tornadoweb/tornado/security/advisories/GHSA-mgf9-4vpg-hj56 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tornado | < 6.5.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 16, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |