{"vulnerability": "GHSA-chx6-46f5-w4vp", "sightings": [{"uuid": "007543a3-84f1-4704-9c86-8c1683a728ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-CHX6-46F5-W4VP", "type": "seen", "source": "https://gist.github.com/alon710/4eb0a4d284209506ac506877e54675ad", "content": "# GHSA-CHX6-46F5-W4VP: GHSA-CHX6-46F5-W4VP: Uncontrolled Resource Consumption in Tornado CurlAsyncHTTPClient\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-30\n> **Full Report:** https://cvereports.com/reports/GHSA-CHX6-46F5-W4VP\n\n## Summary\nA critical uncontrolled resource consumption vulnerability exists in the Tornado web server's libcurl-based HTTP client (CurlAsyncHTTPClient). When processing highly compressed responses with response decompression enabled, the client experiences unbounded memory growth. This leads to host memory exhaustion and denial of service via application crashes.\n\n## TL;DR\nTornado's CurlAsyncHTTPClient lacks size limits and backpressure during decompression, allowing a remote server to trigger process termination via memory exhaustion using a decompression bomb.\n\n## Technical Details\n\n- **CWE ID**: CWE-409, CWE-400\n- **Attack Vector**: Network (Unauthenticated Upstream Server)\n- **CVSS v3.1**: 7.5 (High)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **Impact**: Denial of Service (OOM Crash)\n- **Affected Component**: tornado.curl_httpclient.CurlAsyncHTTPClient\n\n## Affected Systems\n\n- Tornado CurlAsyncHTTPClient\n- **Tornado**: < 6.5.9 (Fixed in: `6.5.9`)\n- **Tornado**: == 6.6.0.dev1 (Fixed in: `6.6.0`)\n\n## Mitigation\n\n- Upgrade Tornado to 6.5.9 or 6.6.0.\n- Switch backend HTTP client from CurlAsyncHTTPClient to SimpleAsyncHTTPClient.\n- Disable automatic decompression (decompress_response=False) for untrusted upstream URLs.\n\n**Remediation Steps:**\n1. Run 'pip install --upgrade tornado>=6.5.9' to patch the environment.\n2. Verify codebases for uses of 'tornado.curl_httpclient.CurlAsyncHTTPClient' and transition backends if upgrade is delayed.\n3. Ensure HTTP clients fetch data with explicit size limits and handle decompression payloads downstream with safety bounds.\n\n## References\n\n- [GitHub Security Advisory GHSA-CHX6-46F5-W4VP](https://github.com/advisories/GHSA-CHX6-46F5-W4VP)\n- [Tornado Pull Request #3719](https://github.com/tornadoweb/tornado/pull/3719)\n- [Tornado Release v6.5.9](https://github.com/tornadoweb/tornado/releases/tag/v6.5.9)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-CHX6-46F5-W4VP) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-01T05:30:30.000000Z"}]}