CVE-2026-49855: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) in tornadoweb tornado
Description
Tornado's gzip decompression routines work in limited-size chunks, but have no overall limit for the total size of decompressed chunks that they will accumulate (There has always been a limit for the total *compressed* size). This allows a malicious server to consume effectively unlimited amounts of memory if it is accessed via SimpleAsyncHTTPClient in its default configuration. `HTTPServer` is not affected in its default configuration, but it is if `decompress_request=True` is set. This bug is fixed in Tornado 6.5.6. `max_body_size` is now checked both for the compressed and cumulative decompressed size of the response. Prior to upgrading, this issue can be mitigated by setting `decompress_response=False` or using `CurlAsyncHTTPClient`.
CVSS v3.1
Score 7.5high
Affected software
tornadoweb
tornado
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-49855 is a vulnerability in the Tornado Python web framework's gzip decompression implementation prior to version 6.5.6. While Tornado processes gzip data in limited-size chunks, it does not enforce a global limit on the total decompressed data size. This flaw can be exploited by a malicious server to cause a client using SimpleAsyncHTTPClient or a server configured with decompress_request=True to consume effectively unlimited memory, leading to a denial of service. The vulnerability is addressed by applying the fix in Tornado 6.5.6.
Potential Impact
The vulnerability allows an attacker controlling a malicious server to cause a client or server using Tornado's affected gzip decompression functionality to consume excessive memory, resulting in denial of service. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Upgrade Tornado to version 6.5.6 or later, where this vulnerability is fixed. Patch status is confirmed by the vendor advisory stating the issue is resolved in 6.5.6. No other mitigations are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-01T22:03:19.640Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a56a08668715ace432de5ea
Added to database: 07/14/2026, 20:48:06 UTC
Last enriched: 07/21/2026, 22:03:13 UTC
Last updated: 10/12/2026, 18:48:20 UTC
Views: 190
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.