CVE-2026-115927

What it actually does

Tornado processes HTTP/1.1 chunked transfer encoding without yielding to the event loop, allowing a remote peer to send millions of one-byte chunks that monopolize the single-threaded event loop and stall all other connections on the process; non-streaming handlers also retain each chunk as a separate object leading to roughly 20x memory amplification relative to received body size, and the same loop-blocking behavior exists in SimpleAsyncHTTPClient when fetching responses.

Why it matters to the business

A single unauthenticated attacker can render an entire Tornado-based service unresponsive to legitimate traffic within seconds, causing widespread denial of service that affects every connection handled by the affected process and may require process restarts to recover; the issue appeared only three days ago with no known exploitation yet.

How an attack unfolds

An attacker opens a single HTTP/1.1 connection to a Tornado server and transmits a request body using chunked transfer encoding, sending millions of one-byte chunks in rapid succession. Because the decoder never yields to the event loop, the Tornado process remains busy handling the incoming chunks, preventing any other I/O or request processing. The same technique can be used against SimpleAsyncHTTPClient when it reads a malicious server response. No authentication or special privileges are required.

How to fix it

Upgrade all Tornado installations to version 6.6.0 or later. Where immediate upgrade is not possible, enforce request timeouts at a reverse proxy or load balancer, restrict chunked encoding at the network edge, and ensure handlers use @stream_request_body where feasible to reduce per-chunk object retention.

How to confirm the fix worked

After upgrade, confirm the Tornado version string reports 6.6.0 or higher; run a synthetic load test that sends many small chunks and verify that other concurrent requests continue to be served without excessive latency; monitor process CPU and memory under the test to ensure no single connection can starve the loop.

Typical attack path

1. Establish a TCP connection to a Tornado HTTP endpoint
2. Issue an HTTP/1.1 request declaring chunked transfer encoding
3. Transmit millions of single-byte chunks without closing the connection
4. Observe that the Tornado event loop stops servicing other sockets
5. Optionally repeat against SimpleAsyncHTTPClient clients

How to detect it

Search web-server and application logs for HTTP requests that declare Transfer-Encoding: chunked and contain an unusually high number of small chunks or extremely long chunked bodies; look for processes showing sustained 100% CPU on a single thread while handling a single connection; correlate with connection-duration metrics that exceed normal request timeouts.

What your security team should do

• Prioritize upgrade to Tornado 6.6.0 across all environments within the next 7 days given the three-day-old disclosure
• Add application-level request timeouts and body-size limits at any ingress proxy
• Audit code for handlers that do not use @stream_request_body and consider refactoring high-traffic endpoints
• Include the new chunked-encoding behavior in load and chaos testing suites