Red Hat Security Advisory

RHSA-2026:82040

python-tornado security update

Released 2026-10-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) python-tornado-6.5.10-1.el9_8.1, python3-tornado-6.5.10-1.el9_8.1

Fixes 1 record

TI-2026-65637 CVE-2026-103262 · GHSA-h36x-fm6v-f9vx

Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

HIGH 77

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00628 Published 2026-10-01 Partial fix · 6.5.9 CWE-409