ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-115927

Tornado is a Python web framework and asynchronous networking library.

Published Oct 26, 2026 · catalog updated Oct 28, 2026 · Red Hat Red Hat Enterprise Linux

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-115927. EPSS is 0.38%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
Medium5.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.38%
Remediation
Version ranges on file
Affected products
Debian:12 python-tornado · Debian:13 python-tornado · Debian:14 python-tornado · PyPI tornado · pip tornado · pypi tornado

### Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop (and therefore every other connection served by that process) for the entire time it takes to parse the body. A body near the default of 100 MB can block the process for close to a minute, and the attacker can repeat or parallelize these requests. Bodies made of tiny chunks also consumed far more memory than their size: a handler that does not use stored each chunk as a separate object, using roughly 20 times as much memory as the bytes received. ### Impact All Tornado HTTP servers are affected when they receive a request body for a handler that reads it, which includes any handler that does not reject the request before the body is read. No authentication is required. Lowering reduces the maximum blocking time and memory use for each request but does not remove the issue. is affected in the same way when it reads a response from a malicious server. ### Patches Fixed in Tornado 6.6. Tornado now yields to the event loop periodically while reading any body, combines small chunks before passing them to , and stores non-streaming bodies more compactly. Applications using should note that the pieces passed to no longer correspond to HTTP chunk boundaries. ### Workarounds - Run Tornado behind a reverse proxy that buffers request bodies and forwards them with a header instead of chunked encoding. - Lower (for the whole server or for individual handlers) to limit the impact of each request. ### Credit Reported by [uttej-badwane](https://github.com/uttej-badwane).

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Debian:12 python-tornado6.2.0-3, 6.2.0-3+deb12u1, 6.2.0-3+deb12u2
  • Debian:13 python-tornado6.4.2-3, 6.4.2-3+deb13u1, 6.4.2-3+deb13u2
  • Debian:14 python-tornado6.4.2-3, 6.5.2-1, 6.5.2-2
  • PyPI tornado0 → 6.6
  • pip tornado< 6.6
  • pypi tornado<6.6.0

How to fix CVE-2026-115927

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-115927. EPSS is 0.38%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Which versions are affected?

Compare what you have installed with 6.2.0-3, 6.2.0-3+deb12u1, 6.2.0-3+deb12u2, 6.4.2-3, 6.4.2-3+deb13u1, 6.4.2-3+deb13u2, 6.4.2-3, 6.5.2-1, 6.5.2-2, 0 → 6.6, < 6.6, <6.6.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-1322; CWE-400: Uncontrolled Resource Consumption; CWE-770: Allocation of Resources Without Limits or Throttling. EPSS 0.38%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Debian security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 26, 2026 · Red Hat Security Data

    Detected

    tornado: Tornado: Denial of Service via chunked transfer encoding processing

  2. Oct 27, 2026 · Trivy Vulnerability DB

    Updated

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering m

  3. Oct 28, 2026 · GitHub Advisory Database

    Fix available

    tornado fixed in 6.6

  4. Oct 28, 2026 · GitHub Advisory Database

    Fix available

    tornado fixed in 6.6

  5. Oct 28, 2026 · GitHub Advisory Database

    Updated

    ### Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop (and therefore every other connection served by that process) for the entire time it takes to parse the body. A body near the default of 100

Sources

  • CVE.orgVulnerability recordCVE-2026-115927

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-r4j5-9xpp-3985

    Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-115927

    When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop (and therefore every other connection served by that process) for the entire time it takes to parse the body. A body near the default max_body_size of 10

    advisories.gitlab.com
  • GitLab Advisory DatabasePackage advisorypypi/tornado/CVE-2026-115927.yml

    When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, + it processes all chunks that have already arrived without yielding to the event + loop. A client can send a body made of millions of 1-byte chunks, which blocks the + event loop (and therefore every other connection served by that process) for the + entire time it takes to parse the body. A body near the default + of 100 MB

    gitlab.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-r4j5-9xpp-3985

    Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

    osv.dev
  • Red Hat Security DataVendor advisoryCVE-2026-115927

    tornado: Tornado: Denial of Service via chunked transfer encoding processing

    access.redhat.com
  • Trivy Vulnerability DBPackage advisoryDEBIAN-CVE-2026-115927

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-by

    osv.dev

References

Freshness

Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitHub Advisory DatabaseOct 30, 2026
  • GitLab Advisory DatabaseOct 29, 2026
  • GitLab Advisory DatabaseOct 29, 2026
  • OpenSSF OSV / OSV ScannerOct 29, 2026
  • CVE.orgOct 27, 2026
  • Trivy Vulnerability DBOct 27, 2026
  • Red Hat Security DataOct 27, 2026