Rocky Linux 10.2 [CIQ] Security Update: python-tornado-debugsource / python3-tornado / etc (crlsa-2026_82041)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202682041 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly...

MiracleLinux 9 : python-tornado-6.5.10-1.el9_8.1 (AXSA:2026-2053:04)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2053:04 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block...

Rocky Linux 9 [CIQ] Security Update: python-tornado-debugsource / python3-tornado / etc (crlsa-2026_82040)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202682040 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly fr...

python-tornado security update

An update is available for python-tornado. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...

RLSA-2026:82041 Important: python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

python-tornado security update

An update is available for python-tornado. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...

RLSA-2026:82040 Important: python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

RockyLinux 9 : python-tornado (RLSA-2026:82040)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:82040 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly...

AlmaLinux 9 : python-tornado (ALSA-2026:82040)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:82040 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly...

RockyLinux 10 : python-tornado (RLSA-2026:82041)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:82041 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly...

AlmaLinux 10 : python-tornado (ALSA-2026:82041)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:82041 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly...

Important: Red Hat Security Advisory: python-tornado security update

An update for python-tornado is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient

A flaw was found in Tornado. A remote malicious server can cause a Denial of Service DoS when an application using the CurlAsyncHTTPClient component fetches an untrusted web address. Because the client fails to enforce limits on incoming response sizes, the attacker can return a small, highly...

Important: Red Hat Security Advisory: python-tornado security update

An update for python-tornado is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient

A flaw was found in Tornado. A remote malicious server can cause a Denial of Service DoS when an application using the CurlAsyncHTTPClient component fetches an untrusted web address. Because the client fails to enforce limits on incoming response sizes, the attacker can return a small, highly...

Important: python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

ALSA-2026:82041 Important: python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

ALSA-2026:82040 Important: python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via curlhttpclient.py in CurlAsyncHTTPClient, which passes every...

CVE-2026-103262

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...