AZL-105378

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-105378.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-105378

Upstream

CVE-2026-103262

Published

2026-10-01T11:17:21Z

Modified

2026-10-05T05:32:41Z

Summary

CVE-2026-103262 affecting package python-tornado 6.3.3-11

Details

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-103262

Affected packages

Azure Linux:3 / python-tornado

Package

Name: python-tornado
Purl: pkg:rpm/azure-linux/python-tornado

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

6.3.3-11

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-105378.json"