AIKIDO-2026-368326
tornado is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
tornadoTL;DR
CurlAsyncHTTPClient buffers and decompresses a response body with no upper limit, so a server that returns a highly compressed body can expand it to far more data than the wire size and exhaust the client process's memory. This applies whether or not a streaming_callback is used, since both the buffered write path and the streaming write path accepted chunks unconditionally. The fix adds a max_body_size argument, tracked against the decompressed size, that pauses and then fails the transfer once the limit is reached.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and configure AsyncHTTPClient to use CurlAsyncHTTPClient to fetch responses from servers you do not fully trust.
Background info
tornado is vulnerable to Denial of Service (DoS) in versions 0.2 - 6.5.8.
How to fix this
Upgrade the tornado library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.