CVE-2026-49855

What it actually does

Tornado's gzip decompression in SimpleAsyncHTTPClient and HTTPServer (with decompress_request=True) processes small chunks without enforcing a cumulative limit on decompressed output, enabling unbounded memory allocation.

Why it matters to the business

Applications can be forced into denial-of-service through memory exhaustion, causing outages or degraded service for users and backend systems.

How an attack unfolds

An attacker controls or compromises a server that responds to requests from a vulnerable Tornado client or server. The server sends gzip-encoded responses split into many small chunks whose decompressed total exceeds available memory, triggering repeated allocation until the process is killed or becomes unresponsive.

How to fix it

Upgrade Tornado to version 6.5.6 or later. If immediate upgrade is not possible, disable decompress_request on HTTPServer and avoid using SimpleAsyncHTTPClient against untrusted origins.

How to confirm the fix worked

Confirm the installed Tornado version is 6.5.6 or newer. Test decompression behavior with a server that emits many small gzip chunks whose total uncompressed size exceeds a few hundred megabytes and verify memory usage remains bounded.

Typical attack path

1. Identify a target using Tornado's SimpleAsyncHTTPClient or an HTTPServer with decompress_request enabled.
2. Serve a malicious gzip response whose decompressed size is crafted to grow without bound across multiple chunks.
3. Trigger repeated requests or a single long-lived connection that forces the client/server to fully decompress the payload.
4. Observe memory growth leading to OOM kill or severe performance degradation.

How to detect it

Monitor Python process memory usage for sudden unbounded growth correlated with incoming or outgoing HTTP traffic; review logs for repeated gzip decompression on connections from a single origin.

What your security team should do

• Upgrade all Tornado installations to 6.5.6 immediately.
• Audit code for any use of decompress_request=True and remove or guard it.
• Implement resource limits and monitoring for Python processes to detect abnormal memory growth.
• Review outbound HTTP clients that may contact untrusted servers and add allow-listing where feasible.