{"id":"CVE-2026-115927","aliases":["AZL-111733","CLSA-2026-1793872514","CLSA-2026-1794218750","DEBIAN-CVE-2026-115927","EUVD-2026-110077","GHSA-r4j5-9xpp-3985","OESA-2026-4798","OESA-2026-4799","OESA-2026-4800","UBUNTU-CVE-2026-115927","openSUSE-SU-2026:12440-1"],"status":"published","title":"Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks","description":"Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00384,"percentile":0.32913,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2026-10-26T19:37:40Z","modified":"2026-11-12T17:25:21Z","fixes":[{"ecosystem":"PyPI","package":"tornado","fixed_in":["6.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.3.3-11"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1"},{"fixed":"6.1.0.post11+tuxcare"}]}],"versions":["6.1","6.1.0.post1+tuxcare","6.1.0.post10+tuxcare","6.1.0.post2+tuxcare","6.1.0.post3+tuxcare","6.1.0.post4+tuxcare","6.1.0.post5+tuxcare","6.1.0.post6+tuxcare","6.1.0.post7+tuxcare","6.1.0.post8+tuxcare","6.1.0.post9+tuxcare"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.1"},{"fixed":"5.1.1.post7+tuxcare"}]}],"versions":["5.1.1","5.1.1.post1+tuxcare","5.1.1.post2+tuxcare","5.1.1.post3+tuxcare","5.1.1.post4+tuxcare","5.1.1.post5+tuxcare","5.1.1.post6+tuxcare"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-3","6.2.0-3+deb12u1","6.2.0-3+deb12u2","6.2.0-3+deb12u3","6.2.0-3+deb12u4","6.3.2-1","6.4.0-1","6.4.0-2","6.4.1-1","6.4.1-2","6.4.1-3","6.4.2-1","6.4.2-2","6.4.2-3","6.5.2-1","6.5.2-2","6.5.2-3","6.5.4-0.1","6.5.4-1","6.5.5-1","6.5.5-2","6.5.5-3","6.5.5-4","6.5.5-5"]},{"source":"osv","ecosystem":"Debian:13","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.2-3","6.4.2-3+deb13u1","6.4.2-3+deb13u2","6.5.2-1","6.5.2-2","6.5.2-3","6.5.4-0.1","6.5.4-1","6.5.5-1","6.5.5-2","6.5.5-3","6.5.5-4","6.5.5-5"]},{"source":"osv","ecosystem":"Debian:14","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.2-3","6.5.2-1","6.5.2-2","6.5.2-3","6.5.4-0.1","6.5.4-1","6.5.5-1","6.5.5-2","6.5.5-3","6.5.5-4","6.5.5-5"]},{"source":"osv","ecosystem":"PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6"}]}],"versions":["0.2","1.0","1.1","1.1.1","1.2","1.2.1","2.0","2.1","2.1.1","2.2","2.2.1","2.3","2.4","2.4.1","3.0","3.0.1","3.0.2","3.1","3.1.1","3.2","3.2.1","3.2.2","4.0","4.0.1","4.0.2","4.1","4.1b2","4.2","4.2.1","4.2b1","4.3","4.3b1","4.3b2","4.4","4.4.1","4.4.2","4.4.3","4.4b1","4.5","4.5.1","4.5.2","4.5.3","4.5b1","4.5b2","5.0","5.0.1","5.0.2","5.0a1","5.0b1","5.1","5.1.1","5.1b1","6.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0a1","6.0b1","6.1","6.1b1","6.1b2","6.2","6.2b1","6.2b2","6.3","6.3.1","6.3.2","6.3.3","6.3b1","6.4","6.4.1","6.4.2","6.4b1","6.5","6.5.1","6.5.10","6.5.2","6.5.3","6.5.4","6.5.5","6.5.6","6.5.7","6.5.8","6.5.9","6.5b1","6.6a1","6.6b1","6.6rc1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6-1.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6-1.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6-1.oe2403sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.1-1ubuntu2","4.2.1-1ubuntu3","4.2.1-1ubuntu3.1","4.2.1-1ubuntu3.1+esm1","4.2.1-1ubuntu3.1+esm2","4.2.1-1ubuntu3.1+esm3","4.2.1-1ubuntu3.1+esm4","4.2.1-1ubuntu3.1+esm5","4.2.1-1ubuntu3.1+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.1-2.1~build2","4.5.2-1","4.5.3-1","4.5.3-1ubuntu0.1","4.5.3-1ubuntu0.2","4.5.3-1ubuntu0.2+esm1","4.5.3-1ubuntu0.2+esm2","4.5.3-1ubuntu0.2+esm3","4.5.3-1ubuntu0.2+esm4","4.5.3-1ubuntu0.2+esm5","4.5.3-1ubuntu0.2+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.1-4ubuntu1","5.1.1-4ubuntu5","6.0.3+really5.1.1-2","6.0.3+really5.1.1-2build1","6.0.3+really5.1.1-2build2","6.0.3+really5.1.1-3","6.0.3+really5.1.1-3ubuntu0.1~esm1","6.0.3+really5.1.1-3ubuntu0.1~esm3","6.0.3+really5.1.1-3ubuntu0.1~esm5","6.0.3+really5.1.1-3ubuntu0.1~esm7","6.0.3+really5.1.1-3ubuntu0.1~esm8","6.0.3+really5.1.1-3ubuntu0.1~esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1build1","6.1.0-2","6.1.0-3","6.1.0-3build1","6.1.0-3ubuntu0.1~esm1","6.1.0-3ubuntu0.1~esm2","6.1.0-3ubuntu0.1~esm4","6.1.0-3ubuntu0.1~esm5","6.1.0-3ubuntu0.1~esm6","6.1.0-3ubuntu0.1~esm7","6.1.0-3ubuntu0.1~esm8"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.3.2-1","6.4.0-0ubuntu1","6.4.0-1","6.4.0-1build1","6.4.0-1ubuntu0.1","6.4.0-1ubuntu0.2","6.4.0-1ubuntu0.4","6.4.0-1ubuntu0.5","6.4.0-1ubuntu0.6","6.4.0-1ubuntu0.7","6.4.0-1ubuntu0.8"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.4-0.1","6.5.5-2","6.5.5-4","6.5.5-5","6.5.5-5ubuntu1.1","6.5.5-5ubuntu1.2","6.5.5-5ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.2-3","6.5.2-3","6.5.4-0.1","6.5.4-0.1ubuntu0.1","6.5.4-0.1ubuntu0.2","6.5.4-0.1ubuntu0.3","6.5.4-0.1ubuntu0.4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6-1.1"}]}],"bundled":3}],"products":[{"vendor":"tornadoweb","product":"tornado"}],"references":[{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-r4j5-9xpp-3985","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/tornadoweb/tornado/pull/3773","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/tornadoweb/tornado/commit/ceab33581489751a66fba8566ad6d5960d4b01c8","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/tornadoweb/tornado/releases/tag/v6.6.0","tags":["x_refsource_MISC","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115927","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-r4j5-9xpp-3985"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115927.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-115927","tags":["advisory"]},{"url":"https://github.com/tornadoweb/tornado","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4798","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116577","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116578","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4799","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4800","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-115927","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-115927","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-115927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116578","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-115927","title":"Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks","description":"Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.","status":"published","published":"2026-10-26T19:37:40.584Z","modified":"2026-10-27T14:18:44.227Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:20:01.618694Z"}],"euvd":[{"id":"EUVD-2026-110077","description":"Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.","status":"published","published":"2026-10-26T19:37:40Z","modified":"2026-10-27T14:18:44Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:59:23.601588Z"}],"ghsa":[{"id":"GHSA-r4j5-9xpp-3985","title":"Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks","description":"### Summary\n\nWhen Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop (and therefore every other connection served by that process) for the entire time it takes to parse the body. A body near the default `max_body_size` of 100 MB can block the process for close to a minute, and the attacker can repeat or parallelize these requests.\n\nBodies made of tiny chunks also consumed far more memory than their size: a handler that does not use `@stream_request_body` stored each chunk as a separate object, using roughly 20 times as much memory as the bytes received.\n\n### Impact\n\nAll Tornado HTTP servers are affected when they receive a request body for a handler that reads it, which includes any handler that does not reject the request before the body is read. No authentication is required. Lowering `max_body_size` reduces the maximum blocking time and memory use for each request but does not remove the issue.\n\n`SimpleAsyncHTTPClient` is affected in the same way when it reads a response from a malicious server.\n\n### Patches\n\nFixed in Tornado 6.6. Tornado now yields to the event loop periodically while reading any body, combines small chunks before passing them to `data_received`, and stores non-streaming bodies more compactly.\n\nApplications using `@stream_request_body` should note that the pieces passed to `data_received` no longer correspond to HTTP chunk boundaries.\n\n### Workarounds\n\n- Run Tornado behind a reverse proxy that buffers request bodies and forwards them with a `Content-Length` header instead of chunked encoding.\n- Lower `max_body_size` (for the whole server or for individual handlers) to limit the impact of each request.\n\n### Credit\n\nReported by [uttej-badwane](https://github.com/uttej-badwane).","status":"published","published":"2026-10-28T22:43:50Z","modified":"2026-10-28T22:43:51Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:41:39.926569Z"}],"nvd":[{"id":"CVE-2026-115927","description":"Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.","status":"published","published":"2026-10-26T20:17:52.397Z","modified":"2026-10-27T15:16:32.303Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:13:03.452847Z"}],"osv":[{"id":"CVE-2026-115927","title":"Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks","description":"Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.","status":"published","published":"2026-10-26T19:37:40.584Z","modified":"2026-11-06T17:27:22.119172816Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-06T18:03:02.904489Z"},{"id":"DEBIAN-CVE-2026-115927","description":"Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.","status":"published","published":"2026-10-26T20:17:52.397Z","modified":"2026-10-28T09:47:26.481750546Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:50.923612Z"},{"id":"GHSA-r4j5-9xpp-3985","title":"Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks","description":"### Summary\n\nWhen Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop (and therefore every other connection served by that process) for the entire time it takes to parse the body. A body near the default `max_body_size` of 100 MB can block the process for close to a minute, and the attacker can repeat or parallelize these requests.\n\nBodies made of tiny chunks also consumed far more memory than their size: a handler that does not use `@stream_request_body` stored each chunk as a separate object, using roughly 20 times as much memory as the bytes received.\n\n### Impact\n\nAll Tornado HTTP servers are affected when they receive a request body for a handler that reads it, which includes any handler that does not reject the request before the body is read. No authentication is required. Lowering `max_body_size` reduces the maximum blocking time and memory use for each request but does not remove the issue.\n\n`SimpleAsyncHTTPClient` is affected in the same way when it reads a response from a malicious server.\n\n### Patches\n\nFixed in Tornado 6.6. Tornado now yields to the event loop periodically while reading any body, combines small chunks before passing them to `data_received`, and stores non-streaming bodies more compactly.\n\nApplications using `@stream_request_body` should note that the pieces passed to `data_received` no longer correspond to HTTP chunk boundaries.\n\n### Workarounds\n\n- Run Tornado behind a reverse proxy that buffers request bodies and forwards them with a `Content-Length` header instead of chunked encoding.\n- Lower `max_body_size` (for the whole server or for individual handlers) to limit the impact of each request.\n\n### Credit\n\nReported by [uttej-badwane](https://github.com/uttej-badwane).","status":"published","published":"2026-10-28T22:43:50Z","modified":"2026-10-28T23:00:04.082411607Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"OESA-2026-4798","title":"python-tornado security update","description":"Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived connection to each user.\r\n\r\nSecurity Fix(es):\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.(CVE-2026-115927)\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado\u0026apos;s HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.(CVE-2026-116577)\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application\u0026apos;s domain for phishing. This issue is fixed in version 6.6.(CVE-2026-116578)","status":"published","published":"2026-11-11T12:26:16Z","modified":"2026-11-11T12:45:07.500813004Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4799","title":"python-tornado security update","description":"Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived connection to each user.\r\n\r\nSecurity Fix(es):\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.(CVE-2026-115927)\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado\u0026apos;s HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.(CVE-2026-116577)\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application\u0026apos;s domain for phishing. This issue is fixed in version 6.6.(CVE-2026-116578)","status":"published","published":"2026-11-11T12:26:17Z","modified":"2026-11-11T12:45:07.504282553Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4800","title":"python-tornado security update","description":"Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived connection to each user.\r\n\r\nSecurity Fix(es):\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.(CVE-2026-115927)\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado\u0026apos;s HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.(CVE-2026-116577)\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application\u0026apos;s domain for phishing. This issue is fixed in version 6.6.(CVE-2026-116578)","status":"published","published":"2026-11-11T12:26:17Z","modified":"2026-11-11T12:45:06.745550266Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"UBUNTU-CVE-2026-115927","description":"Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.","status":"published","published":"2026-10-26T20:17:00Z","modified":"2026-11-12T17:25:21.357317131Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-12T18:05:20.578263Z"},{"id":"AZL-111733","title":"CVE-2026-115927 affecting package python-tornado 6.3.3-11","description":"Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.","status":"published","published":"2026-10-26T20:17:52Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"CLSA-2026-1793872514","title":"TuxCare security update for tornado (3 CVEs)","description":"TuxCare rebuilt tornado to address 3 CVEs. Fixed in 6.1.0.post11+tuxcare.","status":"published","published":"2026-11-05T10:55:15Z","modified":"2026-11-05T13:15:16.678127586Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1794218750","title":"TuxCare security update for tornado (3 CVEs)","description":"TuxCare rebuilt tornado to address 3 CVEs. Fixed in 5.1.1.post7+tuxcare.","status":"published","published":"2026-11-09T11:05:51Z","modified":"2026-11-09T19:15:14.554614128Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"openSUSE-SU-2026:12440-1","title":"python313-tornado6-6.6-1.1 on GA media","description":"These are all security issues fixed in the python313-tornado6-6.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-05T00:00:00Z","modified":"2026-11-06T17:23:10.698741151Z","updated_at":"2026-11-06T18:05:03.243497Z"}]}}