Tornado CVE-2026-103262

Three concrete prerequisites must all hold: (1) the Tornado application must be explicitly configured to use CurlAsyncHTTPClient (via AsyncHTTPClient.configure to the curl implementation) - the default SimpleAsyncHTTPClient is NOT vulnerable because the CVE-2026-49855 size gates live in code the curl client never executes; (2) the request must leave decompress_response at its default True so libcurl advertises gzip,deflate and auto-decodes; and (3) the application must fetch a URL the attacker controls or has compromised so a malicious server can return the gzip bomb. The limiting factors are therefore the non-default client choice and the need for the app to fetch attacker-influenced URLs (SSRF-like or proxy/third-party fetch patterns); the only incidental ceiling before the patch was request_timeout (default 20s), which still permits multi-GB accumulation. There is no authentication required of the attacker and no victim user interaction. Patch adds max_body_size (default 100MB, measured post-decompression).

This is a genuine but conditionally-gated denial-of-service issue, not a high-CVSS-but-illusory one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 driven entirely by VA:H, with zero confidentiality or integrity impact (VC:N/VI:N) - consistent with CWE-409 (improper handling of highly compressed data / decompression bomb) and the description's OOM-kill outcome. No EPSS score, no CISA KEV listing, and no standalone weaponized exploit are present in the input, so there is no public exploit identified at time of analysis; the GHSA advisory does, however, contain detailed end-to-end reproduction (RSS 30MB→1008MB in 3.18s, exit 137 OOMKilled) that substantially lowers the barrier to weaponization. The headline caveat is that the raw CVSS PR:N/AC:L overstates real-world exposure: exploitation only applies when the application is deliberately configured to use the non-default CurlAsyncHTTPClient AND fetches an attacker-chosen or attacker-compromised URL - the default SimpleAsyncHTTPClient is NOT affected (its size gates from CVE-2026-49855 fully mitigate this). So the CVSS vector is technically defensible but the effective population of vulnerable deployments is far narrower than AV:N/PR:N suggests; treat as a real priority only for services that use the curl client to fetch untrusted/third-party URLs.

A Tornado application configured with CurlAsyncHTTPClient (commonly chosen for proxy support or advanced TLS) calls fetch() against a URL an attacker controls or has compromised, with the default decompress_response=True. The malicious server returns Content-Encoding: gzip with a ~2.8MB wire 'bomb'; libcurl auto-decompresses it into an unbounded BytesIO buffer (no max_body_size check existed), driving the process RSS to ~1GB in roughly 3 seconds until the kernel OOM-kills it. No authentication is required of the attacker (they operate the responding server), and no user interaction is needed; the advisory provides a verified reproduction though no standalone exploit script is published.