HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-103262 — Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerabi...

·Source: NIST NVD

Updated:

Executive Summary

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.

Analysis

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions. CVSS Score: 7.5. Published: 2026-10-01T11:17:21.050.

Indicators of Compromise (1)

CVE (1)
CVE-2026-103262
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 1, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-19652 — The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation i...

The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `dmem_form_submit_handler()` function determining the new user's role by iterating all WordPress roles and calling `password_verify()` against an attacker-controlled bcrypt hash supplied in the `form_id` POST parameter, with no validation or whitelist of allowe

CVE-2026-19652
NIST NVD
MEDIUMVulnerability

The EDR blind spot: 3 ways browser attacks evade endpoint telemetry

Browser-based attacks can steal sessions, abuse extensions, or manipulate users without creating the endpoint artifacts EDR is designed to detect. NordLayer explains three ways attacks can evade endpoint telemetry and why browser-level controls can help close the gap. [...]

BleepingComputer
CRITICALVulnerability

NVD CRITICAL: CVE-2026-104611 — A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown fu...

A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown function of the file /goform/fast_setting_internet_set of the component POST Request Handler. Performing a manipulation of the argument netWanType results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.

CVE-2026-104611
NIST NVD