{"metadata": {"vulnerability": "GHSA-R4J5-9XPP-3985", "count": 21, "kinds": {"milestone": 8, "sighting": 2, "kev": 0, "other": 11}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-23T20:21:45.108Z", "date_only": false, "value": "2026-10-23T20:21:45.108Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5 \u00b7 CVE-2026-115927", "record": "CVE-2026-115927", "field": "cveMetadata.dateReserved", "linked_record": true}, {"timestamp": "2026-10-26T19:37:40.584Z", "date_only": false, "value": "2026-10-26T19:37:40.584Z", "kind": "milestone", "label": "Published", "source": "cvelistv5 \u00b7 CVE-2026-115927", "record": "CVE-2026-115927", "field": "cveMetadata.datePublished", "linked_record": true}, {"timestamp": "2026-10-26T19:37:40.584Z", "date_only": false, "value": "2026-10-26T19:37:40.584Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2026-115927 / GitHub_M", "record": "CVE-2026-115927", "field": "containers.cna.providerMetadata.dateUpdated", "linked_record": true}, {"timestamp": "2026-10-26T19:42:03.528Z", "date_only": false, "value": "2026-10-26T19:42:03.528765Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117508913377629500", "record": "GHSA-r4j5-9xpp-3985", "field": "creation_timestamp", "uuid": "0d928508-fb88-4cad-b0f0-65b9c3ded09c", "content": "CVE-2026-115927 Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-115927https://github.com/tornadoweb/tornado/security/advisories/GHSA-r4j5-9xpp-3985https://github.com/tornadoweb/tornado/pull/3773https://github.com/tornadoweb/tornado/commit/ceab33581489751a66fba8566ad6d5960d4b01c8https://github.com/tornadoweb/tornado/releases/tag/v6.6.0#tornadoweb #tornado#CVE_2026_115927#bot", "url": "https://infosec.exchange/users/cve/statuses/117508913377629500"}, {"timestamp": "2026-10-26T20:17:52Z", "date_only": false, "value": "2026-10-26T20:17:52Z", "kind": "other", "label": "Nvd published at", "source": "github", "record": "GHSA-R4J5-9XPP-3985", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-27T13:45:56.157Z", "date_only": false, "value": "2026-10-27T13:45:56.157686Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 \u00b7 CVE-2026-115927 / CISA-ADP", "record": "CVE-2026-115927", "field": "containers.adp.0.metrics.0.other.content.timestamp", "linked_record": true}, {"timestamp": "2026-10-27T14:18:44.227Z", "date_only": false, "value": "2026-10-27T14:18:44.227Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2026-115927", "record": "CVE-2026-115927", "field": "cveMetadata.dateUpdated", "linked_record": true}, {"timestamp": "2026-10-27T14:18:44.227Z", "date_only": false, "value": "2026-10-27T14:18:44.227Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2026-115927 / CISA-ADP", "record": "CVE-2026-115927", "field": "containers.adp.0.providerMetadata.dateUpdated", "linked_record": true}, {"timestamp": "2026-10-28T22:43:50Z", "date_only": false, "value": "2026-10-28T22:43:50Z", "kind": "milestone", "label": "Published", "source": "github", "record": "GHSA-R4J5-9XPP-3985", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T22:43:50Z", "date_only": false, "value": "2026-10-28T22:43:50Z", "kind": "other", "label": "Updated", "source": "github", "record": "GHSA-R4J5-9XPP-3985", "field": "modified"}, {"timestamp": "2026-10-28T23:30:50Z", "date_only": false, "value": "2026-10-28T23:30:50.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/87878df851f5f6bf760d152e650937c6", "record": "GHSA-r4j5-9xpp-3985", "field": "creation_timestamp", "uuid": "5da02de5-3815-4cf5-9454-cb7a6dd15e54", "content": "# CVE-2026-115927: CVE-2026-115927: Event Loop Blocking and Memory Amplification in Tornado Chunked Transfer Encoding Parser\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-10-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-115927\n\n## Summary\nTornado versions prior to 6.6.0 contain an uncontrolled resource consumption vulnerability (CWE-400) in the HTTP/1.1 chunked transfer encoding parser. When processing incoming chunked payloads that have already buffered in the socket read buffer, Tornado parses chunks in a tight synchronous loop without yielding to the event loop. Furthermore, non-streaming request handlers and SimpleAsyncHTTPClient store each chunk as a discrete Python bytes object inside a list, inducing an approximately 20-fold memory overhead for 1-byte chunks.\n\n## TL;DR\nAn unauthenticated remote attacker can send an HTTP/1.1 request or response with millions of 1-byte chunks to a Tornado server or client (< 6.6.0), monopolizing the Python asyncio event loop and causing approximately 20x memory amplification.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CVE ID**: CVE-2026-115927 (GHSA-r4j5-9xpp-3985)\n- **CWE Classification**: CWE-400 (Uncontrolled Resource Consumption) / CWE-770\n- **CVSS v3.1 Score**: 5.3 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)\n- **Attack Vector**: Network (Unauthenticated HTTP/1.1 Chunked Transfer Encoding)\n- **Affected Component**: tornado/http1connection.py, httpserver.py, web.py, simple_httpclient.py\n- **Security Impact**: Process-wide IOLoop starvation and ~20x memory amplification\n- **EPSS Score**: 0.384% (32.33rd percentile)\n- **Patched Version**: Tornado 6.6.0\n\n## Affected Systems\n\n- Tornado Web Framework (< 6.6.0)\n- Tornado HTTPServer (< 6.6.0)\n- Tornado SimpleAsyncHTTPClient (< 6.6.0)\n- **tornado**: < 6.6.0 (Fixed in: `6.6.0`)\n\n## Mitigation\n\n- Upgrade Tornado to version 6.6.0 or newer to enable periodic event loop yielding and bytearray chunk coalescing.\n- Deploy an upstream HTTP reverse proxy (such as NGINX with proxy_request_buffering enabled) in front of Tornado servers to normalize and buffer incoming chunked requests.\n- Configure strict max_body_size limits on HTTPServer and SimpleAsyncHTTPClient instances to cap maximum per-request resource consumption.\n- Use CurlAsyncHTTPClient instead of SimpleAsyncHTTPClient when making outbound HTTP requests to untrusted third-party servers on Tornado versions prior to 6.6.0.\n\n**Remediation Steps:**\n1. Audit application dependencies and virtual environments to identify installations of tornado < 6.6.0.\n2. Run `pip install --upgrade 'tornado>=6.6.0'` and update requirements.txt, pyproject.toml, or lockfiles accordingly.\n3. Verify reverse proxy configurations (e.g., NGINX, AWS ALB, HAProxy) to ensure HTTP request buffering is not disabled unless explicitly required for streaming endpoints.\n4. Restart all Tornado worker processes and services to load the patched library.\n\n## References\n\n- [NVD - CVE-2026-115927](https://nvd.nist.gov/vuln/detail/CVE-2026-115927)\n- [CVE.org Record - CVE-2026-115927](https://www.cve.org/CVERecord?id=CVE-2026-115927)\n- [GitHub Security Advisory GHSA-r4j5-9xpp-3985](https://github.com/tornadoweb/tornado/security/advisories/GHSA-r4j5-9xpp-3985)\n- [Tornado Pull Request #3773](https://github.com/tornadoweb/tornado/pull/3773)\n- [Tornado Patch Commit ceab33581489751a66fba8566ad6d5960d4b01c8](https://github.com/tornadoweb/tornado/commit/ceab33581489751a66fba8566ad6d5960d4b01c8)\n- [Tornado v6.6.0 Release Tag](https://github.com/tornadoweb/tornado/releases/tag/v6.6.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-115927) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/87878df851f5f6bf760d152e650937c6"}, {"timestamp": "2026-10-29T10:22:35Z", "date_only": false, "value": "2026-10-29T10:22:35Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-LIVERELOAD-CVE-2026-115927", "record": "BREW-LIVERELOAD-CVE-2026-115927", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-29T21:41:23Z", "date_only": false, "value": "2026-10-29T21:41:23Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-NVCHECKER-CVE-2026-115927", "record": "BREW-NVCHECKER-CVE-2026-115927", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-29T21:41:23Z", "date_only": false, "value": "2026-10-29T21:41:23Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-NVCHECKER-CVE-2026-115927", "record": "BREW-NVCHECKER-CVE-2026-115927", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-29T21:44:32Z", "date_only": false, "value": "2026-10-29T21:44:32Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-SICKCHILL-CVE-2026-115927", "record": "BREW-SICKCHILL-CVE-2026-115927", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-29T21:44:32Z", "date_only": false, "value": "2026-10-29T21:44:32Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-SICKCHILL-CVE-2026-115927", "record": "BREW-SICKCHILL-CVE-2026-115927", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-29T22:14:32Z", "date_only": false, "value": "2026-10-29T22:14:32Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-JUPYTERLAB-CVE-2026-115927", "record": "BREW-JUPYTERLAB-CVE-2026-115927", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-29T22:14:32Z", "date_only": false, "value": "2026-10-29T22:14:32Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-JUPYTERLAB-CVE-2026-115927", "record": "BREW-JUPYTERLAB-CVE-2026-115927", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-29T23:28:46Z", "date_only": false, "value": "2026-10-29T23:28:46Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-LIVERELOAD-CVE-2026-115927", "record": "BREW-LIVERELOAD-CVE-2026-115927", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T00:29:26Z", "date_only": false, "value": "2026-10-30T00:29:26Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-SNAKEVIZ-CVE-2026-115927", "record": "BREW-SNAKEVIZ-CVE-2026-115927", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T00:29:26Z", "date_only": false, "value": "2026-10-30T00:29:26Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-SNAKEVIZ-CVE-2026-115927", "record": "BREW-SNAKEVIZ-CVE-2026-115927", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-11T07:25:17.828Z", "anchors": {"origin": {"timestamp": "2026-10-28T22:43:50Z", "date_only": false, "value": "2026-10-28T22:43:50Z", "kind": "milestone", "label": "Published", "source": "github", "record": "GHSA-R4J5-9XPP-3985", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-28T22:43:50Z", "date_only": false, "value": "2026-10-28T22:43:50Z", "kind": "milestone", "label": "Published", "source": "github", "record": "GHSA-R4J5-9XPP-3985", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1154487.828506, "hours": 320.6910634738889, "days": 13.362127644745371, "min_seconds": 1154487.828506, "max_seconds": 1154487.828506, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T22:43:50Z", "date_only": false, "value": "2026-10-28T22:43:50Z", "kind": "milestone", "label": "Published", "source": "github", "record": "GHSA-R4J5-9XPP-3985", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-11T07:25:17.828Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}