CVE-2026-49855

Deferred Deferred - Pending Action

Memory Exhaustion in Tornado via Gzip Decompression

Publication date: 2026-07-14

Last updated on: 2026-07-16

Assigner: GitHub, Inc.

Description

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer configured with decompress_request=True to consume effectively unlimited memory. This issue is fixed in version 6.5.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-16

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-49855

Affected Vendors & Products

Vendor	Product	Version / Range
facebook	tornado	6.5.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-409	The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

Executive Summary

Tornado is a Python web framework that had a vulnerability in its gzip decompression routines before version 6.5.6. The issue allowed a malicious server to send specially crafted data that would cause the decompression process to consume excessive memory on the client side when using SimpleAsyncHTTPClient or on the server side if HTTPServer was configured with decompress_request=True.

Detection Guidance

This vulnerability can be detected by checking the Tornado version in use. If your system runs Tornado versions prior to 6.5.6, it is vulnerable. Run: pip show tornado or python -c "import tornado; print(tornado.version)" to verify the installed version.

Impact Analysis

This vulnerability could lead to denial-of-service attacks by exhausting system memory. If exploited, it may cause applications to slow down, crash, or become unresponsive due to high memory usage. Systems using vulnerable versions of Tornado for HTTP requests or responses with gzip compression could be affected.

Compliance Impact

This vulnerability could lead to denial-of-service (DoS) conditions by exhausting server memory, potentially disrupting availability of systems handling sensitive data. For GDPR, this may impact the right to access or availability of services. For HIPAA, it could affect the integrity and availability of protected health information systems.

Mitigation Strategies

Upgrade Tornado to version 6.5.6 or later to address the memory consumption issue in gzip decompression routines.

Hi! I’m here to help you understand CVE-2026-49855. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70