EUVD-2026-110077
GHSA-r4j5-9xpp-3985
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect to Tornado HTTP server
-
DeliverySend chunked POST with millions of 1-byte chunks
-
ExploitBody parser processes chunks without yielding
-
ExecutionEvent loop blocked, memory amplified ~20x
-
ImpactAll connections on process stalled (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable remotely without authentication (PR:N/UI:N) against default Tornado configurations, with one real prerequisite: the target handler must actually read the request body - i.e., any handler that does not reject the request before the body is read (typically POST/PUT endpoints). The attack specifically requires HTTP/1.1 chunked transfer encoding with many tiny (e.g., one-byte) chunks. The default max_body_size of 100 MB allows a single request to block the process for close to a minute. Limiting factors per the advisory: lowering max_body_size reduces per-request blocking time and memory use but does not remove the issue; placing Tornado behind a reverse proxy that buffers bodies and forwards them with a Content-Length header (instead of chunked) neutralizes the request-side vector. SimpleAsyncHTTPClient is exposed in the same way only when it reads a response from a malicious/attacker-controlled server. Servers running many worker processes dilute, but do not eliminate, the per-process stall. |
| Impact | This is a genuine but moderate-priority availability issue, not a critical emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) is internally consistent with the description: remote, network-reachable, low complexity, no privileges, no user interaction, and availability-only impact with no confidentiality or integrity loss. The vuln.today decision label is 'this_month' (not act_now or emergency), which aligns with a resource-exhaustion flaw rather than code execution. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no signal of active or widespread exploitation. The one point of tension is impact magnitude: the base vector rates availability as Low (A:L), but the GHSA advisory describes blocking the entire process event loop - stalling every connection served by that process for close to a minute per request, repeatable and parallelizable, plus ~20x memory amplification for non-streaming handlers. A full-process stall that an unauthenticated peer can sustain is arguably a stronger availability impact than A:L suggests; defenders running single-process or few-worker deployments should treat it as more serious than the 5.3 score implies. Overall: a real, easily-reachable DoS worth patching on a normal maintenance cadence, with higher urgency for internet-facing Tornado servers that accept request bodies and run few worker processes. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a POST (or other body-bearing request) using HTTP/1.1 chunked transfer encoding composed of millions of one-byte chunks to any Tornado handler that reads the request body. Tornado parses all already-arrived chunks without yielding, monopolizing the process event loop and stalling every other connection on that process, while non-streaming handlers also balloon memory to roughly 20x the received bytes. The patch adds a repeatable DoS benchmark harness (maint/benchmark/dos_benchmark.py) demonstrating the cost; this is a reproduction/measurement tool, not verified standalone weaponized exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Event-loop starvation in the Tornado Python web framework and async networking library before 6.6.0 allows a remote, unauthenticated attacker to stall every connection handled by a worker process by submitting an HTTP/1.1 chunked request body made of millions of one-byte chunks to any handler that reads the body. Because the decoder processes already-arrived body bytes without yielding to the event loop, a body near the default 100 MB max_body_size can block the process for close to a minute, and for handlers without @stream_request_body each retained chunk costs roughly twenty times the received bytes in memory. The same behaviour affects SimpleAsyncHTTPClient when it reads a response from a malicious server; no public exploit identified at time of analysis, and the issue is addressed in the 6.6.0 release rather than treated as an emergency by available triage signals.
RemediationAI
Vendor-released patch: upgrade to Tornado 6.6.0 or later (pip install --upgrade 'tornado>=6.6.0'), as documented in the release notes at https://github.com/tornadoweb/tornado/releases/tag/v6.6.0 and the advisory at https://github.com/tornadoweb/tornado/security/advisories/GHSA-r4j5-9xpp-3985; the code change is in https://github.com/tornadoweb/tornado/pull/3773. If upgrading cannot be done immediately, the vendor lists two workarounds with real trade-offs: front Tornado with a reverse proxy that buffers request bodies and forwards them with a Content-Length header instead of chunked encoding, which removes the request-side vector but changes chunk-boundary semantics and shifts buffering memory, disk and latency onto the proxy; or lower max_body_size globally or per handler, which only shortens the blocking window and memory footprint per request while leaving the issue in place, and may break legitimate large uploads. Running multiple worker processes dilutes but does not eliminate the per-process stall. Operators adopting 6.6.0 with @stream_request_body handlers should verify application logic does not assume data_received pieces match HTTP chunk boundaries, since small chunks are now coalesced.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-400 (Uncontrolled Resource Consumption) with the advisory also tagging CWE-770 (Allocation of Resources Without Limits or Throttling), rooted in Tornado's HTTP/1.1 message parser. Under chunked transfer encoding the peer controls how many discrete chunks compose a body, and Tornado's decoder processed every chunk that had already arrived in a single synchronous pass instead of periodically yielding to the asyncio event loop; a stream of tiny chunks therefore converts a small number of received bytes into a long, uninterrupted parser run that starves all other coroutines on that process. A second factor is storage representation: handlers that do not use the @stream_request_body decorator kept each chunk as a distinct Python object, so a body of one-byte chunks consumed roughly twenty times the bytes received. SimpleAsyncHTTPClient exhibits the symmetric behaviour on the client side when parsing a response from an attacker-controlled server. The 6.6.0 fix yields to the event loop periodically while reading any body, coalesces small chunks before invoking data_received, and stores non-streaming bodies more compactly; the same release also turns a chunk not followed by CRLF into an HTTPInputError instead of an AssertionError (or silent acceptance under python -O) and coalesces websocket pings so a peer that never reads pongs cannot grow server memory without bound. Applications using @stream_request_body must note that data_received pieces no longer align with HTTP chunk boundaries.
Know when Tornado gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Remote, no auth or interaction, low complexity; raised availability to High because an unauthenticated peer can repeatedly stall the entire process event loop for all connections, not merely degrade service.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.
Blast Radius
ecosystem impact- 14,702 pypi packages depend on tornado (1,258 direct, 13,586 indirect)
Ecosystem-wide dependent count for version 6.6.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An issue in Docmosis Tornado v.2.9.7 and before allows a remote attacker to execute arbitrary code via a crafted script
An issue was discovered in Docmosis Tornado prior to version 2.9.5. Rated high severity (CVSS 8.8), this vulnerability i
py3-tornado in Alpine Linux received a security fix packaged as version 6.5.4-r0, addressing an unspecified vulnerabilit
Docmosis Tornado <= 2.9.4 is vulnerable to Directory Traversal leading to the disclosure of arbitrary content on the fil
An issue was discovered in Docmosis Tornado prior to version 2.9.5. Rated high severity (CVSS 7.5), this vulnerability i
Denial of service in the Tornado web framework's CurlAsyncHTTPClient (all releases before 6.5.9) lets an unauthenticated
In versions of Tornado prior to 6.5.5, the only limit on the number of parts in `multipart/form-data` is the `max_body_s
Memory amplification denial of service in the Tornado Python web framework before 6.5.8 lets unauthenticated remote atta
Credential leakage in Tornado's CurlAsyncHTTPClient (all releases through 6.5.6) lets sensitive per-request state — clie
Unauthenticated local file disclosure in Tornado before 6.5.9 lets remote attackers read files outside a configured stat
Denial-of-service in Tornado prior to 6.5.8 allows unauthenticated remote attackers to stall the entire server by sendin
Tornado Python web framework on Alpine Linux received a security fix in package version 6.5.4-r0, addressing an uncharac
Exploit-DB