CVE-2026-115927: Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

Vulnerability summary

CVE-2026-115927 is a medium (CVSS 5.3) Uncontrolled Resource Consumption vulnerability in tornadoweb tornado. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 32.4% of scored vulnerabilities.

Timeline

1. 26-10-2026
   PublishedVulnerability first disclosed.
2. 27-10-2026
   Last modifiedVulnerability information updated.

Description

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.