Threats tagged 'brew-jupyterlab-cve-2026-103262'

CVE-2026-103262 is a high-severity vulnerability in Tornado's CurlAsyncHTTPClient where no response size limit is enforced during decompression, allowing a decompression bomb to cause unbounded memory growth. An attacker-controlled server can send a gzip-compressed payload that expands massively in memory, causing the client process to consume gigabytes of RAM and potentially be killed by the operating system's out-of-memory (OOM) killer. This issue affects Tornado versions from 1.2.0 up to but not including 4.6.4. The vulnerability is distinct from a previously fixed decompression bomb issue in SimpleAsyncHTTPClient, as CurlAsyncHTTPClient lacks the size checks present in that client. A fix is available in Tornado 4.6.4.