{"id":"ghsa-ghsa-r4j5-9xpp-3985","seq":2056904,"kind":"advisory","title":"Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks","url":"https://github.com/advisories/GHSA-r4j5-9xpp-3985","permalink":"https://vulnpulse.app/items/ghsa-ghsa-r4j5-9xpp-3985","summary":"影響: pip:tornado < 6.6 → 6.6\nWhen Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop (and therefore every other connection served by that process) for the entire time it takes to parse the body. A body near the default max_body_size of 100 MB can block the process for close to a minute, and the attacker can repeat or parallelize these…","severity":"medium","techs":["python"],"cves":["CVE-2026-115927"],"tags":["GHSA-r4j5-9xpp-3985","tornado"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T22:43:50.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}