CVE-2026-103262

A flaw was found in Tornado. A remote malicious server can cause a Denial of Service (DoS) when an application using the CurlAsyncHTTPClient component fetches an untrusted web address. Because the client fails to enforce limits on incoming response sizes, the attacker can return a small, highly compressed payload (a decompression bomb) that expands to an enormous size. This unbounded memory consumption exhausts system resources and crashes the application.

Last checked: 2026-10-06 02:12 UTC

• Proof of concept · CISA Coordinator (Assessed 2026-10-06 00:08 UTC)

References

• NVD: CVE-2026-103262
• Upstream Advisory

Fix Status by Distribution