CVE-2026-103262

Summary

Tornado's CurlAsyncHTTPClient is vulnerable to unbounded memory accumulation when processing gzip-compressed responses, allowing attackers to trigger a denial of service through decompression bombs that consume all available memory.

Exploitability

Exploitation is relatively straightforward as attackers only need to send a specially crafted gzip-encoded response to trigger the memory accumulation issue, requiring no authentication or complex preconditions.

Blast radius

The vulnerability could affect any Tornado application using CurlAsyncHTTPClient with compressed responses, potentially causing widespread service disruption across multiple applications and users.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Tornado 6.5.9 or later to remediate this memory accumulation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.