Security1 hOctober 1, 2026, 12:31

GHSA-CHX6-46F5-W4VP: Uncontrolled Resource Consumption in Tornado CurlAsyncHTTPClient

A high-severity uncontrolled resource consumption flaw (CVSS 7.5) was found in Tornado's libcurl-based CurlAsyncHTTPClient. With response decompression enabled, highly compressed responses cause unbounded memory growth, leading to host memory exhaustion and denial of service. Fixed in Tornado 6.5.9 and 6.6.0.

DEV Community

Open source

CVSS 7.5, CWE-409 and CWE-400, network attack vector, unauthenticated
Affects tornado.curl_httpclient.CurlAsyncHTTPClient in Tornado < 6.5.9
Fixed in Tornado 6.5.9 and 6.6.0, PoC available
Workaround: switch to SimpleAsyncHTTPClient or set decompress_response=False

#Tornado

Microsoft: JadePuffer hijacked Azure identities to destroy cloud resources

Security

61% of production cloud resources had no backups, Eon finds

Security

JADEPUFFER attackers used compromised service principals to delete Azure resources

Science

GHSA-CHX6-46F5-W4VP: Uncontrolled Resource Consumption in Tornado CurlAsyncHTTPClient

Microsoft: JadePuffer hijacked Azure identities to destroy cloud resources

61% of production cloud resources had no backups, Eon finds

JADEPUFFER attackers used compromised service principals to delete Azure resources

Lockheed Martin rolls out first F-35A stealth jet for Germany to replace aging Tornados