93 matches found
RockyLinux 10 : python-tornado (RLSA-2026:82041)
The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:82041 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly...
AlmaLinux 10 : python-tornado (ALSA-2026:82041)
The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:82041 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly...
RockyLinux 9 : python-tornado (RLSA-2026:82040)
The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:82040 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly...
AlmaLinux 9 : python-tornado (ALSA-2026:82040)
The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:82040 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly...
Important: Red Hat Security Advisory: python-tornado security update
An update for python-tornado is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...
tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient
A flaw was found in Tornado. A remote malicious server can cause a Denial of Service DoS when an application using the CurlAsyncHTTPClient component fetches an untrusted web address. Because the client fails to enforce limits on incoming response sizes, the attacker can return a small, highly...
Important: Red Hat Security Advisory: python-tornado security update
An update for python-tornado is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...
tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient
A flaw was found in Tornado. A remote malicious server can cause a Denial of Service DoS when an application using the CurlAsyncHTTPClient component fetches an untrusted web address. Because the client fails to enforce limits on incoming response sizes, the attacker can return a small, highly...
ALSA-2026:82040 Important: python-tornado security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
Important: python-tornado security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
ALSA-2026:82041 Important: python-tornado security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
SUSE CVE-2026-103262
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...
Improper Handling of Highly Compressed Data (Data Amplification)
Overview tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via curlhttpclient.py in CurlAsyncHTTPClient, which passes every...
AZL-105378 CVE-2026-103262 affecting package python-tornado 6.3.3-11
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...
DEBIAN-CVE-2026-103262
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...
CVE-2026-103262
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...
UBUNTU-CVE-2026-103262
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...
CVE-2026-103262
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...
CVE-2026-103262
A flaw was found in Tornado. A remote malicious server can cause a Denial of Service DoS when an application using the CurlAsyncHTTPClient component fetches an untrusted web address. Because the client fails to enforce limits on incoming response sizes, the attacker can return a small, highly...
CVE-2026-103262 Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...