CVE-2026-103262: Tornado CurlAsyncHTTPClient DOS Vulnerability

CVE-2026-103262 Overview

CVE-2026-103262 is a denial-of-service vulnerability in the Tornado web framework affecting versions prior to 6.5.9. The flaw resides in CurlAsyncHTTPClient, which fails to bound the memory consumed when processing compressed HTTP responses. Remote attackers can send a gzip-encoded decompression bomb that expands without size limits in memory. The accumulation triggers an out-of-memory (OOM) condition, causing the operating system to terminate the Tornado process. The weakness is classified under CWE-409: Improper Handling of Highly Compressed Data (Data Amplification).

Critical Impact
Unauthenticated remote attackers can crash Tornado applications that use CurlAsyncHTTPClient to fetch external resources, enabling service outages with a single compressed response.

Affected Products

Tornado web framework versions prior to 6.5.9
Applications using the tornado.curl_httpclient.CurlAsyncHTTPClient component
Python services relying on libcurl through Tornado for outbound HTTP requests

Discovery Timeline

2026-10-01 - CVE-2026-103262 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-103262

Vulnerability Analysis

Tornado's CurlAsyncHTTPClient wraps libcurl to perform asynchronous HTTP requests. When a server returns a response with Content-Encoding: gzip, the client decompresses the payload into memory. Prior to 6.5.9, no cap existed on the size of the decompressed body. An attacker-controlled or attacker-influenced upstream server can return a small compressed payload that expands to gigabytes in memory. The Tornado process accumulates the decompressed data until the host kernel invokes the OOM killer, terminating the application.

This is a classic data amplification attack. The compression ratio of gzip against highly repetitive input can exceed 1000:1, meaning a few megabytes of attacker traffic can exhaust many gigabytes of RAM on the target host.

Root Cause

The CurlAsyncHTTPClient constructor did not expose or enforce a max_body_size parameter. Response bodies were buffered without a configurable upper bound, so decompressed content accumulated until memory was exhausted. The upstream fix in commit e412435f adds a max_body_size argument defaulting to 100 MiB (104857600 bytes) and requires libcurl 7.81 or higher to enforce the limit.

Attack Vector

Exploitation requires that a vulnerable Tornado service make an outbound HTTP request to an attacker-controlled or compromised server. Common patterns include:

Server-side URL fetching features (link previews, webhooks, image proxies)
Federated or crawler services that follow user-supplied URLs
Microservices that aggregate data from external APIs vulnerable to compromise

The attacker responds with a gzip-encoded body advertising a small Content-Length while the decompressed payload is enormous. No authentication is required on the Tornado side.

text

// Patch excerpt — docs/httpclient.rst
-.. class:: CurlAsyncHTTPClient(max_clients=10, defaults=None)
+.. class:: CurlAsyncHTTPClient(max_clients=10, defaults=None, max_body_size=104857600)

   ``libcurl``-based HTTP client.

Source: Tornado commit e412435f

text

// Patch excerpt — docs/index.rst (dependency uplift)
-  ``tornado.curl_httpclient``.  Libcurl version 7.22 or higher is required.
+  ``tornado.curl_httpclient``.  Libcurl version 7.81 or higher is required
+  (the version shipped by Ubuntu 22.04 LTS).

Source: Tornado commit e412435f

Detection Methods for CVE-2026-103262

Indicators of Compromise

- Tornado worker processes terminated by the Linux OOM killer, visible in dmesg or /var/log/syslog entries referencing python or tornado as the sacrificed task
- Sudden spikes in resident set size (RSS) for Tornado processes correlated with outbound HTTP responses carrying Content-Encoding: gzip
- Outbound HTTP traffic to untrusted hosts returning high decompression ratios (small body, very large Content-Length after decompression)

Detection Strategies

- Inventory Python dependencies and flag any tornado version below 6.5.9 that imports tornado.curl_httpclient
- Add runtime guards that log and alert when AsyncHTTPClient.fetch returns bodies exceeding an expected threshold
- Instrument reverse proxies to log the ratio between compressed and decompressed response sizes for traffic destined to Tornado backends

Monitoring Recommendations

- Monitor per-process memory metrics for Tornado workers and alert on rapid growth preceding termination
- Track OOM-kill events on hosts running Tornado and correlate with recent outbound fetch targets
- Record and review the destination domains of outbound HTTP requests initiated by Tornado services for anomalous or user-supplied URLs

How to Mitigate CVE-2026-103262

Immediate Actions Required

- Upgrade Tornado to version 6.5.9 or later across all production, staging, and build environments
- Where upgrade is not immediate, switch outbound HTTP calls from CurlAsyncHTTPClient to SimpleAsyncHTTPClient with an explicit max_body_size
- Audit application code for user-controlled URLs reaching the Tornado HTTP client and restrict them to allow-listed destinations

Patch Information

The fix is delivered in Tornado 6.5.9 via commit e412435f, which adds a max_body_size parameter (default 104857600 bytes) to CurlAsyncHTTPClient and raises the minimum libcurl requirement to 7.81. Review the Tornado GHSA-chx6-46f5-w4vp advisory and the VulnCheck advisory for upstream guidance.

Workarounds

- Explicitly set a conservative max_body_size when constructing CurlAsyncHTTPClient to cap decompressed response size
- Enforce per-process memory limits on Tornado workers using systemd MemoryMax or container --memory constraints to contain OOM impact
- Terminate TLS and inspect compressed response size at an upstream proxy, rejecting responses with abnormal compression ratios

bash

# Pin a safe version of Tornado and verify the libcurl runtime
pip install --upgrade 'tornado>=6.5.9'
python -c "import pycurl; print(pycurl.version)"

# Constrain memory for Tornado workers at the systemd unit level
# /etc/systemd/system/tornado-app.service.d/limits.conf
[Service]
MemoryMax=512M
MemoryHigh=400M