CVE-2026-103262

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.5.9

Description A memory accumulation issue exists in the CurlAsyncHTTPClient component. Remote attackers can trigger a denial of service by sending a gzip-encoded decompression bomb, which is a highly compressed file that expands to a massive size when decompressed. This causes memory to accumulate without size limits, leading the application process to be terminated due to out-of-memory conditions.

Recommendations Update to version 6.5.9 or later.