Threats tagged 'brew-livereload-cve-2026-115927'

Tornado HTTP servers are vulnerable to event loop blocking and excessive memory use when processing HTTP/1.1 chunked transfer encoded bodies composed of many small chunks. An attacker can send a request body with millions of 1-byte chunks, causing the server to block the event loop for extended periods and consume significantly more memory than the actual body size. This affects any handler that reads the request body without prior rejection and requires no authentication. The issue also impacts Tornado's SimpleAsyncHTTPClient when reading responses from malicious servers. The vulnerability is fixed in Tornado 6.6.