SUSE CVE-2026-115927

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to...

CVE-2026-111816

A flaw was found in Apache Traffic Server. Malformed HTTP 302 redirect responses containing chunked transfer encoding are improperly forwarded instead of being rejected as parse errors. A remote attacker can exploit this condition to cause HTTP response desynchronization and cache poisoning,...

CVE-2013-2028-Exploit

CVE-2013-2028 Exploit Vulnerability Details Vulnerable software: Nginx 1.3.9 Vulnerable function: ngxhttpparsechunked CVE-2013-2028 is an integer overflow vulnerability in Nginx's HTTP chunked transfer encoding parser. Under the conditions targeted by this laboratory environment, the vulnerabilit...

CVE-2025-55315-detection-playground

Here are some tests that can be performed against these services to observe different behavior on GET/POST routes between the patched and unpatched versions of Kestrel. GET against unpatched sends 200 and socket remains open printf 'GET / HTTP/1.1\r\nHost: localhost\r\nTransfer-Encoding:...

CVE-2026-91920

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size ...

DEBIAN-CVE-2026-91920

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size ...

EUVD-2026-113473

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size ...

PT-2026-133234

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size ...

CVE-2026-91920

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size ...

CVE-2026-109941

A flaw was found in FreeRDP. When processing Remote Desktop RD Gateway connections using HTTP chunked transfer encoding, a malicious or compromised server can send a partial chunk header or footer followed by a clean Transport Layer Security TLS shutdown. This condition causes the client to proce...

CVE-2026-91920

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size ...

Tornado: Event Loop Blocking And Excess Memory Use From Chunked Bodies With Many Small Chunks

Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop and therefore every other connection serve...

Apache Struts 2 REST Plugin 7.4.0 Chunked Request Body Handling

Apache Struts 2 REST Plugin version 7.4.0 and below skips request-body deserialization and maximum-length enforcement when requests use chunked transfer encoding without a Content-Length header...

EUVD-2026-110077

Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks...

GHSA-R4J5-9XPP-3985 Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop and therefore every other connection serve...

Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop and therefore every other connection serve...

CVE-2026-115927

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to...

CVE-2026-115927

A flaw was found in Tornado. When decoding HTTP/1.1 chunked transfer encoding, Tornado processes received data without yielding control back to the event loop. A remote unauthenticated attacker can send requests containing a large volume of small chunks to monopolize the process and consume...

Linux Distros Unpatched Vulnerability : CVE-2026-115927

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body dat...

AZL-111733 CVE-2026-115927 affecting package python-tornado 6.3.3-11

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to...