Red Hat Security Advisory: python-tornado security update

Fixed packages 4

Vulnerabilities 4

• High 7.5
  CVE-2026-103262

  Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

  Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that acc…

  tornadoweb tornado python-tornado python-tornado Debian Ubuntu Azure Linux PyPI
  Oct 1, 2026
• High 7.5
  CVE-2026-49855

  tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

  Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server acces…

  tornadoweb tornado mitmproxy python-tornado Debian Ubuntu Azure Linux Wolfi PyPI
  Jul 14, 2026
• High 7.5
  CVE-2026-82397

  Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

  Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in t…

  tornadoweb tornado kubeflow-pipelines-visualization-server dask-kubernetes Debian Ubuntu Azure Linux Wolfi PyPI
  Aug 31, 2026
• High 7.5
  CVE-2026-91990

  Tornado before 6.5.8 Memory Amplification DoS via multipart

  Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, ex…

  tornadoweb tornado python-tornado python-tornado Debian Ubuntu Azure Linux PyPI
  Sep 15, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2500686
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2526562
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2533953
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2544534
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98107.json
• report
  https://access.redhat.com/security/cve/CVE-2026-49855
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-49855
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-49855
• article
  https://github.com/tornadoweb/tornado/commit/ff808b33adc52d89a549376a5e3628e92abbc8ff
• article
  https://github.com/tornadoweb/tornado/pull/3626
• article
  https://github.com/tornadoweb/tornado/security/advisories/GHSA-mgf9-4vpg-hj56
• report
  https://access.redhat.com/security/cve/CVE-2026-82397
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-82397
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-82397
• article
  https://github.com/tornadoweb/tornado/commit/8d6363ed7b69d5f0da806efe34d256627a2191de
• article
  https://github.com/tornadoweb/tornado/pull/3704
• article
  https://github.com/tornadoweb/tornado/releases/tag/v6.5.8
• article
  https://github.com/tornadoweb/tornado/security/advisories/GHSA-mpf4-983q-p7j4
• report
  https://access.redhat.com/security/cve/CVE-2026-91990
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-91990
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-91990
• article
  https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq
• article
  https://www.vulncheck.com/advisories/tornado-before-6.5.8-memory-amplification-dos-via-multipart
• report
  https://access.redhat.com/security/cve/CVE-2026-103262
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-103262
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-103262
• article
  https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9
• article
  https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp
• article
  https://www.vulncheck.com/advisories/tornado-before-6.5.9-denial-of-service-via-curlasynchttpclient