Skip to content
OpenAdvisories
High RHSA-2026:82041 1 CVE

Red Hat Security Advisory: python-tornado security update

Published Oct 14, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 python-tornado 0:6.5.10-1.el10_2.1
Red Hat · RHEL 10 enterprise_linux:10.2 python-tornado-debugsource 0:6.5.10-1.el10_2.1
Red Hat · RHEL 10 enterprise_linux:10.2 python3-tornado 0:6.5.10-1.el10_2.1
Red Hat · RHEL 10 enterprise_linux:10.2 python3-tornado-debuginfo 0:6.5.10-1.el10_2.1

Vulnerabilities 1

  • High 7.5
    CVE-2026-103262

    Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

    Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that acc…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Azure Linux PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2544534
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82041.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-103262
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-103262
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-103262
  • article
    https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9
  • article
    https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp
  • article
    https://www.vulncheck.com/advisories/tornado-before-6.5.9-denial-of-service-via-curlasynchttpclient