Denial of Service Vulnerability in Tornado Python Web Framework

CVE-2026-115927

What is CVE-2026-115927?

The Tornado web framework and asynchronous networking library has a denial of service vulnerability that arises from its handling of HTTP/1.1 chunked transfer encoding prior to version 6.6.0. When an unauthenticated remote peer sends multiple one-byte chunks, it can monopolize the event loop, effectively stalling all other active connections. This occurs because Tornado processes incoming body data without yielding control to the event loop. Furthermore, when specific handlers don't utilize the @stream_request_body decorator, it can lead to substantial memory consumption, potentially consuming around twenty times the size of the received body. The issue could also be exploited by the SimpleAsyncHTTPClient that displays similar behavior when dealing with potentially malicious server responses. The vulnerability has been patched in Tornado version 6.6.0.

References