# CVE-2026-103262: Tornado CurlAsyncHTTPClient unbounded memory accumulation in decompression

Source: https://junglewise.ai/threats/cve-2026-103262-tornado-curlasynchttpclient-enforces-no-response-size-limit  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-103262 · Severity: high · CVSS 7.5 · Published 2026-10-01

Tornado's curl-based HTTP client lacks response size limits, allowing remote attackers to cause denial of service by sending a gzip-compressed decompression bomb. An attacker can send a small compressed payload that expands to gigabytes in memory, exhausting RAM and crashing the application without any client-side size checks intervening.

Technologies: [tornado (PyPI)](https://junglewise.ai/threats/technologies/tornado), [Tornado](https://junglewise.ai/threats/technologies/tornado-tornado). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Tornado](https://junglewise.ai/threats/vendors/tornado).

## Quick answers

**Is CVE-2026-103262 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103262 being exploited in the wild.

**How severe is CVE-2026-103262?** High severity, with a CVSS score of 7.5, published 1 October 2026.

**Which products and versions are affected?** tornado (PyPI) ECOSYSTEM:introduced=0,fixed=6.5.9; Tornado before 6.5.9.

**Is there a fix for CVE-2026-103262?** Yes. tornado (PyPI): upgrade to 6.5.9 or later. Until then: Configure CurlAsyncHTTPClient with an explicit max_body_size parameter set to a reasonable limit, or disable decompress_response if gzip decompression is not required for your application. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103262 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-103262?** Check whether you run tornado (PyPI) or Tornado at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tornado (PyPI): upgrade to 6.5.9 or later

  ```sh
  pip install "tornado>=6.5.9"
  ```


Configure CurlAsyncHTTPClient with an explicit max_body_size parameter set to a reasonable limit, or disable decompress_response if gzip decompression is not required for your application.

## Technical details

CurlAsyncHTTPClient accumulates decompressed HTTP response bodies in an unbounded BytesIO buffer without enforcing max_body_size limits, unlike SimpleAsyncHTTPClient which implements three size gates (compressed Content-Length, chunked total, and cumulative decompressed size). When decompress_response is enabled (the default), libcurl decompresses payloads before passing them to the write callback, allowing a gzip bomb to expand from kilobytes on the wire to gigabytes in memory at rates exceeding 350 MB/s. The vulnerability requires network-accessible Tornado applications that use CurlAsyncHTTPClient and fetch attacker-influenced URLs.

## Affected products

- Tornado Tornado before 6.5.9

## Identifiers

- CVE-2026-103262
- GHSA-chx6-46f5-w4vp

## Timeline

- 2026-09-14: disclosed
- 2026-09-12: patched

## References

- [https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9](https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9)
- [https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp](https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp)

## Related threats

- [Tornado cookie attribute injection in set_cookie max_age](https://junglewise.ai/threats/cve-2026-123535-tornado-before-6-6-does-not-validate-the-max-age-argument-of)
- [Tornado open redirect in RedirectHandler URL templates](https://junglewise.ai/threats/cve-2026-116578-tornado-is-a-python-web-framework-and-asynchronous-networking)
- [Tornado HTTP header parser quadratic CPU consumption via line folding](https://junglewise.ai/threats/cve-2026-116577-tornado-is-a-python-web-framework-and-asynchronous-networking)
- [Tornado HTTP/1.1 chunked encoding denial of service](https://junglewise.ai/threats/cve-2026-115927-tornado-is-a-python-web-framework-and-asynchronous-networking)
- [Tornado StaticFileHandler path traversal via symlinks](https://junglewise.ai/threats/cve-2026-103263-tornado-staticfilehandler-follows-symlinks-outside-static-root)