CVE catalog
CVE-2026-115927
python-tornado: CVE-2026-115927
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | python-tornado | sid | 6.5.5-5 | vulnerable |
| Debian | python-tornado | forky | 6.5.5-5 | vulnerable |
| Debian | python-tornado | trixie | 6.4.2-3+deb13u2 | vulnerable |
| Debian | python-tornado | trixie-security | 6.4.2-3+deb13u2 | vulnerable |
| Debian | python-tornado | bookworm | 6.2.0-3+deb12u4 | vulnerable |
| Debian | python-tornado | bookworm-security | 6.2.0-3+deb12u4 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | python-tornado | source | sid | (unfixed) | not yet assigned | Not reported | [1152300] |
| Debian | python-tornado | source | forky | (unfixed) | not yet assigned | Not reported | [1152300] |
| Debian | python-tornado | source | trixie | (unfixed) | not yet assigned | Not reported | [1152300] |
| Debian | python-tornado | source | bookworm | (unfixed) | not yet assigned | Not reported | [1152300] |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [python3-tornado]Affected
Source package: [python-tornado]
Details (4)
6.2.0-3+deb12u4· amd64 · bookwormAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· arm64 · bookwormAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· amd64 · bookworm-securityAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· arm64 · bookworm-securityAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
- [python-tornado-doc]Affected
Source package: [python-tornado]
Details (4)
6.2.0-3+deb12u4· all · bookwormAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· all · bookwormAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· all · bookworm-securityAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· all · bookworm-securityAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
[Debian 13 (Trixie)]
- [python3-tornado]Affected
Source package: [python-tornado]
Details (4)
6.4.2-3+deb13u2· amd64 · trixieAffected
dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· arm64 · trixieAffected
dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· amd64 · trixie-securityAffected
dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· arm64 · trixie-securityAffected
dsa · python-tornado · debian · 13
- [python-tornado-doc]Affected
Source package: [python-tornado]
Details (4)
6.4.2-3+deb13u2· all · trixieAffected
dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· all · trixieAffected
dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· all · trixie-securityAffected
dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· all · trixie-securityAffected
dsa · python-tornado · debian · 13
Observed: