Summary
Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop (and therefore every other connection served by that process) for the entire time it takes to parse the body. A body near the default max_body_size of 100 MB can block the process for close to a minute, and the attacker can repeat or parallelize these requests.
Bodies made of tiny chunks also consumed far more memory than their size: a handler that does not use @stream_request_body stored each chunk as a separate object, using roughly 20 times as much memory as the bytes received.
Workarounds
- Run Tornado behind a reverse proxy that buffers request bodies and forwards them with a
Content-Lengthheader instead of chunked encoding. - Lower
max_body_size(for the whole server or for individual handlers) to limit the impact of each request.
Credit
Reported by uttej-badwane.
Impact
All Tornado HTTP servers are affected when they receive a request body for a handler that reads it, which includes any handler that does not reject the request before the body is read. No authentication is required. Lowering max_body_size reduces the maximum blocking time and memory use for each request but does not remove the issue.
SimpleAsyncHTTPClient is affected in the same way when it reads a response from a malicious server.
Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service. Typical impact: denial of service.
CVE-2026-115927 has a CVSS score of 5.3 (Medium). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (6.6); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Fixed in Tornado 6.6. Tornado now yields to the event loop periodically while reading any body, combines small chunks before passing them to data_received, and stores non-streaming bodies more compactly.
Applications using @stream_request_body should note that the pieces passed to data_received no longer correspond to HTTP chunk boundaries.
Frequently Asked Questions
- What is CVE-2026-115927? CVE-2026-115927 is a medium-severity uncontrolled resource consumption vulnerability in tornado (pip), affecting versions < 6.6. It is fixed in 6.6. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.
- How severe is CVE-2026-115927? CVE-2026-115927 has a CVSS score of 5.3 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of tornado are affected by CVE-2026-115927? tornado (pip) versions < 6.6 is affected.
- Is there a fix for CVE-2026-115927? Yes. CVE-2026-115927 is fixed in 6.6. Upgrade to this version or later.
- Is CVE-2026-115927 exploitable, and should I be worried? Whether CVE-2026-115927 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-115927 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-115927? Upgrade
tornadoto 6.6 or later.