CVE-2026-49855 is a vulnerability in the Tornado Python web framework's gzip decompression implementation prior to version 6.5.6. While Tornado processes gzip data in limited-size chunks, it does not enforce a global limit on the total decompressed data size. This flaw can be exploited by a malicious server to cause a client using SimpleAsyncHTTPClient or a server configured with decompress_request=True to consume effectively unlimited memory, leading to a denial of service. The vulnerability is addressed by applying the fix in Tornado 6.5.6.

The vulnerability allows an attacker controlling a malicious server to cause a client or server using Tornado's affected gzip decompression functionality to consume excessive memory, resulting in denial of service. There is no impact on confidentiality or integrity, only availability is affected.

Upgrade Tornado to version 6.5.6 or later, where this vulnerability is fixed. Patch status is confirmed by the vendor advisory stating the issue is resolved in 6.5.6. No other mitigations are indicated.