## Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

- 種別: advisory
- 重大度: medium
- 関連技術: python
- CVE: CVE-2026-115927
- 公開日時: 2026-10-28T22:43:50.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-r4j5-9xpp-3985)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-r4j5-9xpp-3985

影響: pip:tornado < 6.6 → 6.6
When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop (and therefore every other connection served by that process) for the entire time it takes to parse the body. A body near the default max_body_size of 100 MB can block the process for close to a minute, and the attacker can repeat or parallelize these…