High severity7.5GHSA Advisory· Published Jul 14, 2026· Updated Jul 16, 2026
CVE-2026-49855
CVE-2026-49855
Description
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer configured with decompress_request=True to consume effectively unlimited memory. This issue is fixed in version 6.5.6.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
tornadoPyPI | < 6.5.6 | 6.5.6 |
Affected products
7- osv-coords6 versionspkg:rpm/opensuse/python-tornado6&distro=openSUSE%20Tumbleweedpkg:apk/chainguard/mitmproxypkg:apk/wolfi/mitmproxypkg:pypi/tornadopkg:rpm/opensuse/python-tornado6&distro=openSUSE%20Leap%2016.0pkg:rpm/almalinux/python3-tornado
< 6.5.7-1.1+ 5 more
- (no CPE)range: < 6.5.7-1.1
- (no CPE)range: < 12.2.3-r1
- (no CPE)range: < 12.2.3-r1
- (no CPE)range: < 6.5.6
- (no CPE)range: < 6.5-160000.5.1
- (no CPE)range: < 6.5.8-0.el9_8.1
- Range: < 6.5.6
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.