High-Risk Memory Vulnerability in Tornado Web Framework Disclosed

• •CVE-2026-103262 poses a high availability risk due to unbounded memory accumulation.
• •Attackers can exploit this vulnerability via crafted gzip responses without user interaction.
• •Immediate upgrade to Tornado version 6.5.9 or later is recommended to mitigate risks.

An unbounded memory accumulation vulnerability, CVE-2026-103262, has been identified in Tornado versions prior to 6.5.9, specifically within the CurlAsyncHTTPClient. This flaw allows remote attackers to exploit the application by sending a crafted gzip-encoded response, leading to denial of service through excessive memory consumption. The vulnerability was published on October 1, 2026, and is classified with a CVSS score of 8.7, indicating a high risk to availability. Affected systems include Python asynchronous web services utilizing this framework for HTTP client operations. The exploitation status remains unconfirmed as no proof-of-concept or exploitation in the wild has been reported yet. Security professionals are advised to monitor memory usage during HTTP requests and upgrade to the fixed version as a priority.