Bug 2544534 (CVE-2026-103262)

Summary: CVE-2026-103262 tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akhatavk, anpicker, aos-team-art-private, asdas, bbrownin, bparees, dpaolell, dschmidt, ebourniv, eglynn, hasun, ikhan, jdelft, jfula, jjoyce, jlanda, jowilson, jpretori, jschluet, jupierce, jwong, kaycoth, kshier, lgarciaa, lhh, mbiarnes, mburns, mgarciac, nyancey, omaciel, ometelka, ppalepu, ppostler, prdhamdh, ptisnovs, rbobbitt, rhel-process-autobot, rjohnson, sbunciak, sghai, sidsharm, simaishi, stcannon, suppawar, syedriko, ttakamiy, vlaad, watson-tool-maintainers, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Tornado. A remote malicious server can cause a Denial of Service (DoS) when an application using the CurlAsyncHTTPClient component fetches an untrusted web address. Because the client fails to enforce limits on incoming response sizes, the attacker can return a small, highly compressed payload (a decompression bomb) that expands to an enormous size. This unbounded memory consumption exhausts system resources and crashes the application.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2547335, 2547336, 2547337    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-01 10:57:23 UTC 
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.
Comment 1 Jon Orris 2026-10-13 07:01:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:82041 https://access.redhat.com/errata/RHSA-2026:82041
Comment 2 Jon Orris 2026-10-13 07:06:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:82040 https://access.redhat.com/errata/RHSA-2026:82040