CVE-2026-103262

A flaw was found in Tornado. A remote malicious server can cause a Denial of Service DoS when an application using the CurlAsyncHTTPClient component fetches an untrusted web address. Because the client fails to enforce limits on incoming response sizes, the attacker can return a small, highly...

CVE-2026-103262

Tornado versions before 6.5.9 are vulnerable to a Denial of Service (DoS) attack via the CurlAsyncHTTPClient component. The root cause is an unbounded memory accumulation vulnerability where the client fails to enforce limits on incoming response sizes. A remote malicious server can exploit this ...

CVE-2026-103262

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...

CVE-2026-103262 Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...

CVE-2026-103262 Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...

CVE-2026-103262 Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...

SUSE CVE-2026-98067

In the Linux kernel, the following vulnerability has been resolved: erofs: disable LZ4 rolling decompression for now LZ4 rolling decompression 1 was introduced to reduce the memory footprint of temporary pages: For many cases, it is needed for users to read small data within a compressed extent...

MGASA-2026-0463 Updated python-pillow packages fix security vulnerabilities

Prevent decompression bomb when parsing PDF WindowsViewer.getcommand injection EPS image infinite loop JPEG2000 image memory usage McIdas out-of-bounds OOB read Out-of-bounds OOB read when saving 1 mode TGA images Out-of-bounds OOB write from large RankFilter sizes Out-of-bounds OOB write from...

Updated python-pillow packages fix security vulnerabilities

Prevent decompression bomb when parsing PDF WindowsViewer.getcommand injection EPS image infinite loop JPEG2000 image memory usage McIdas out-of-bounds OOB read Out-of-bounds OOB read when saving 1 mode TGA images Out-of-bounds OOB write from large RankFilter sizes Out-of-bounds OOB write from...

CVE-2026-103262: Improper Handling of Highly Compressed Data (Data Amplification)

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...

CVE-2026-103262: Improper Handling of Highly Compressed Data (Data Amplification)

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...

Rocky Linux 10.2 [CIQ] Security Update: fence-agents-all / fence-agents-amt-ws / fence-agents-apc / etc (crlsa-2026_48585)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202648585 advisory. httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies CVE-2026-59939 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: python3-urllib3 Multiple Vulnerabilities (crlsa-2026_1254)

The Rocky Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261254 advisory. urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66418 urllib3: urllib3 Streaming API improperly handles highly...

CentOS Linux 8.4 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1779583115)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1779583115 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the...

Rocky Linux 10.2 [CIQ] Security Update: python3.14-urllib3 Multiple Vulnerabilities (crlsa-2026_27929)

The Rocky Linux 10.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202627929 advisory. urllib3: urllib3: Denial of Service due to excessive HTTP response decompression CVE-2026-44432 urllib3: urllib3: Information disclosure via cross-orig...

Rocky Linux 8 [CIQ] Security Update: pacemaker / pacemaker-cli / pacemaker-cli-debuginfo / etc (crlsa-2026_39322)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202639322 advisory. pacemaker: Pacemaker: Denial of Service via integer overflow in remote message decompression CVE-2026-10649 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: bzip2 / bzip2-debuginfo / bzip2-debugsource / bzip2-devel / etc (crlsa-2025_0733)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20250733 advisory. bzip2: bzip2: Data integrity error when decompressing with data integrity tests fail. CVE-2019-12900 Tenable has extracted the preceding description block directly...

Rocky Linux 9.6 [TuxCare] Security Update: gzip Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1783934943)

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783934943 advisory. - GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is n...

Rocky Linux 9 [CIQ] Security Update: python3-urllib3 Multiple Vulnerabilities (crlsa-2026_1087)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261087 advisory. urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66418 urllib3: urllib3 Streaming API improperly handles highly...

Rocky Linux 9.6 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc (ALMALINUX9.6:CLSA-2026:1768839607)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1768839607 advisory. - The attack vector is a potential Denial of Service DoS. The vulnerability is caused by an insufficient check on the length of a...