CVE-2026-49855CWE-409

tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

High · published July 14, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
46.5
In the wild
Unconfirmed
What it is

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer configured with decompress_request=True to consume effectively unlimited memory. This issue is fixed in version 6.5.6.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00572 · 46.5th percentile
Weakness
CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification)
Published
2026-07-14T20:45Z
EPSS history
Timeline
  • 14 JUL 20:45Z
    tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)
    cvelistv5