CVE-2026-115927

A flaw was found in Tornado. When decoding HTTP/1.1 chunked transfer encoding, Tornado processes received data without yielding control back to the event loop. A remote unauthenticated attacker can send requests containing a large volume of small chunks to monopolize the process and consume excessive memory. This issue leads to a Denial of Service (DoS), stalling all other connections handled by the affected process.

This vulnerability is rated as Moderate because although an unauthenticated remote attacker can trigger a denial of service by stalling the application's event loop and causing substantial memory consumption, the flaw cannot lead to unauthorized data disclosure or system modification. Within Red Hat environments, Tornado is commonly deployed as a backend service behind reverse proxies or within managed container platforms such as OpenShift and OpenStack. The impact is primarily confined to the availability of the specific worker process handling the malicious stream, limiting the overall blast radius across multi-worker architectures.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.