Skip to content
OpenAdvisories
High ALAS2023-2026-3293 1 CVE

Important: python3.13-tornado security update (Amazon Linux 2023)

Published Oct 26, 2026 · Updated Oct 26, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-103262: Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2023 python3.13-tornado 0:6.4.2-1.amzn2023.0.7
Amazon Linux · 2023 python3.13-tornado-debuginfo 0:6.4.2-1.amzn2023.0.7
Amazon Linux · 2023 python3.13-tornado-debugsource 0:6.4.2-1.amzn2023.0.7
Amazon Linux · 2023 python3.13-tornado-doc 0:6.4.2-1.amzn2023.0.7

Vulnerabilities 1

  • High 7.5
    CVE-2026-103262

    Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

    Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that acc…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Azure Linux PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-103262.html