CVE-2026-49855
HighAdvisory
Published 15 Jun 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.006
- 45th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 103
- of 17,781 indexed, latest versions
- Container images
- 108
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)
Carried by container images the latest versions of 103 of 17,781 indexed charts deploy, on 108 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| tornadopypi | 2.4.1, 4.5.3, 5.1.1, 6.0.2+12 more | 6.5.6 | 108 |
| python-tornadodeb | 6.2.0-3+deb12u1 | no fix listed | 1 |
- OSV records
- DEBIAN-CVE-2026-49855GHSA-mgf9-4vpg-hj56
- Also known as
- PYSEC-2026-3389
Charts affected
103 by stars
Container images carrying it
108 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| istio/ | 0a5eb4795952 | tornado | 6.5.6 | 2 |
| istio/ | 22a0410f35a8 | tornado | 6.5.6 | 2 |
| opendatacube/ | 668cbb41473c | tornado | 6.5.6 | 2 |
| alaaamin/ | 46da5844794e | tornado | 6.5.6 | 1 |
| amagdi888/ | d8a10fc8faf6 | tornado | 6.5.6 | 1 |
| amancevice/ | c8c04bfe3d66 | tornado | 6.5.6 | 1 |
| amundsendev/ | 4d98eb21f5f9 | tornado | 6.5.6 | 1 |
| apache/ | 64e58748b6b9 | tornado | 6.5.6 | 1 |
| apache/ | ce90bdc3d2af | tornado | 6.5.6 | 1 |
| apache/ | e5560ad0b86e | tornado | 6.5.6 | 1 |
| apecloud/ | 8ac9947a2c84 | tornado | 6.5.6 | 1 |
| apsl/ | 51e2de5c2c70 | tornado | 6.5.6 | 1 |
| aristidetm/ | 469dbc951224 | tornado | 6.5.6 | 1 |
| aristidetm/ | ccb516cb8474 | tornado | 6.5.6 | 1 |
| baserow/ | e0b3c8130b91 | tornado | 6.5.6 | 1 |
| baserow/ | df0c42eb67e8 | tornado | 6.5.6 | 1 |
| bmeares/ | 8e9c5bacaa82 | tornado | 6.5.6 | 1 |
| cheyang/ | 46cc34755493 | tornado | 6.5.6 | 1 |
| copyparty/ | 0a0a8605062c | tornado | 6.5.6 | 1 |
| daskdev/ | 4ecd7bc35500 | tornado | 6.5.6 | 1 |
| daskdev/ | 052630f5ca04 | tornado | 6.5.6 | 1 |
| ddosify/ | a43c5155fa1c | tornado | 6.5.6 | 1 |
| ddosify/ | e5be48b37348 | tornado | 6.5.6 | 1 |
| errbotio/ | 00ee4e0953ab | tornado | 6.5.6 | 1 |
| esphome/ | 3f51ec10e823 | tornado | 6.5.6 | 1 |
| esphome/ | 9ab8cc88b28c | tornado | 6.5.6 | 1 |
| esphome/ | b2c6322700ac | tornado | 6.5.6 | 1 |
| esphome/ | def8b6e4f517 | tornado | 6.5.6 | 1 |
| factly/ | ca5bc71d1d5c | tornado | 6.5.6 | 1 |
| geoscienceaustralia/ | f4039b45572a | tornado | 6.5.6 | 1 |
| gethue/ | 11b649636e68 | tornado | 6.5.6 | 1 |
| gethue/ | 5702b2c37ff9 | tornado | 6.5.6 | 1 |
| gethue/ | 7d5c1b9f8a79 | tornado | 6.5.6 | 1 |
| gmaas2/ | 148fc2d9afe9 | tornado | 6.5.6 | 1 |
| grafana/ | 499851658393 | tornado | 6.5.6 | 1 |
| homeassistant/ | 021e2afc6e57 | tornado | 6.5.6 | 1 |
| homeassistant/ | 8d000332b09b | tornado | 6.5.6 | 1 |
| ilum/ | ce5dcdeb22ba | tornado | 6.5.6 | 1 |
| intel/ | aa8f5483a2ef | tornado | 6.5.6 | 1 |
| intelowlproject/ | 0b22e547ea6b | tornado | 6.5.6 | 1 |
| istio/ | 6668bcf42ef0 | tornado | 6.5.6 | 1 |
| jaedb/ | 048cfbf58d57 | python-tornado tornado | no fix listed 6.5.6 | 1 |
| josh5/ | 4d49c4816260 | tornado | 6.5.6 | 1 |
| jupyterhub/ | 5a0ceed1300a | tornado | 6.5.6 | 1 |
| jupyterhub/ | b6b4a1a34bf0 | tornado | 6.5.6 | 1 |
| jupyterhub/ | e4770285aaf7 | tornado | 6.5.6 | 1 |
| jupyterhub/ | 8e4778efec8e | tornado | 6.5.6 | 1 |
| jupyterhub/ | e3e6f3051df8 | tornado | 6.5.6 | 1 |
| jupyterjsc/ | aea53b13f235 | tornado | 6.5.6 | 1 |
| kubesphere/ | 378f49ec9c44 | tornado | 6.5.6 | 1 |