7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-49855

CVE-2026-49855: tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer configured with decompress_request=True to consume effectively unlimited memory. This issue is fixed in version 6.5.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-49855

CVE-2026-49855:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
tornado	pip	< 6.5.6	6.5.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a 'gzip bomb' issue in Tornado's HTTP client and server components. The root cause is the lack of a size limit on the cumulative decompressed data within the _GzipMessageDelegate.data_received method in tornado/http1connection.py. This method would continuously decompress incoming gzipped data chunks without checking the total output size. An attacker could exploit this by sending a small, highly compressed payload that, when decompressed, would exhaust system memory, leading to a denial-of-service attack. The fix, found in commit ff808b33adc52d89a549376a5e3628e92abbc8ff, introduces a check against max_body_size after each decompression operation in _GzipMessageDelegate.data_received. The HTTP1Connection.read_response method was also updated to pass this size limit during the delegate's instantiation. Therefore, _GzipMessageDelegate.data_received is the primary vulnerable function where the memory allocation occurs, and HTTP1Connection.read_response is the function that initiates the vulnerable process.

Vulnerable functions

_GzipMessageDelegate.data_received

tornado/http1connection.py

This function is responsible for processing incoming data chunks. In the vulnerable version, when handling gzipped content, it would decompress chunks and accumulate them without checking the total size of the decompressed data. A malicious actor could send a highly compressed payload (a 'gzip bomb'), causing the application to consume an excessive amount of memory upon decompression, leading to a denial of service.

HTTP1Connection.read_response

tornado/http1connection.py

This function initiates the reading of an HTTP response. When the 'decompress' parameter is true, it creates and uses a `_GzipMessageDelegate` to handle the response body. The patch modifies this function to pass the `max_body_size` to the delegate, which is then used to limit the size of the decompressed data. The vulnerability is triggered within the delegate, but this function is the entry point for setting up the vulnerable decompression process.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.