Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

影響: pip:tornado < 6.6 → 6.6

When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop (and therefore every other connection served by that process) for the entire time it takes to parse the body. A body near the default max_body_size of 100 MB can block the process for close to a minute, and the attacker can repeat or parallelize these…

GitHub Advisory Database에서 읽기

2026. 10. 29. 오전 07:43, GitHub Advisory Database에서 "Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python. CVE: CVE-2026-115927.