Skip to content
OpenAdvisories
High RHSA-2026:82040 1 CVE

Red Hat Security Advisory: python-tornado security update

Published Oct 14, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream python-tornado 0:6.5.10-1.el9_8.1
Red Hat · RHEL 9 enterprise_linux:9::appstream python-tornado-debugsource 0:6.5.10-1.el9_8.1
Red Hat · RHEL 9 enterprise_linux:9::appstream python3-tornado 0:6.5.10-1.el9_8.1
Red Hat · RHEL 9 enterprise_linux:9::appstream python3-tornado-debuginfo 0:6.5.10-1.el9_8.1

Vulnerabilities 1

  • High 7.5
    CVE-2026-103262

    Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

    Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that acc…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Azure Linux PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2544534
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82040.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-103262
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-103262
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-103262
  • article
    https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9
  • article
    https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp
  • article
    https://www.vulncheck.com/advisories/tornado-before-6.5.9-denial-of-service-via-curlasynchttpclient