Vulnpedia
← Search CVEs

CVE-2026-103262

HIGH 8.7

Published 2026-10-01 · Last modified 2026-10-06

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.

ELEVATED IMPACT

Severe if exploited (CVSS 8.7), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.6%chance of exploitation in 30 days · 50th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

8.7CVSS 4.0 · HIGH

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable
  • ✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Tornadoweb

Products Tornado

Weakness (CWE)

  • CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • tornado PyPI

    pkg:pypi/tornado

    ECOSYSTEM range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 6.5.9
    84 explicitly listed affected versions

    0.2, 1.0, 1.1, 1.1.1, 1.2, 1.2.1, 2.0, 2.1, 2.1.1, 2.2, 2.2.1, 2.3, 2.4, 2.4.1, 3.0, 3.0.1, 3.0.2, 3.1, 3.1.1, 3.2, 3.2.1, 3.2.2, 4.0, 4.0.1, 4.0.2, 4.1, 4.1b2, 4.2, 4.2.1, 4.2b1, 4.3, 4.3b1, 4.3b2, 4.4, 4.4.1, 4.4.2, 4.4.3, 4.4b1, 4.5, 4.5.1, 4.5.2, 4.5.3, 4.5b1, 4.5b2, 5.0, 5.0.1, 5.0.2, 5.0a1, 5.0b1, 5.1, 5.1.1, 5.1b1, 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0a1, 6.0b1, 6.1, 6.1b1, 6.1b2, 6.2, 6.2b1, 6.2b2, 6.3, 6.3.1, 6.3.2, 6.3.3, 6.3b1, 6.4, 6.4.1, 6.4.2, 6.4b1, 6.5, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5b1

    Additional upstream package constraints
    {
  "database": {
    "last_known_affected_version_range": "<= 6.5.8",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-chx6-46f5-w4vp/GHSA-chx6-46f5-w4vp.json"
  }
}
    GitHub Advisory Database · GHSA-chx6-46f5-w4vp · Updated 2026-10-02T03:56:11.819291984Z

Vendor product assessments

Showing 32 of 793 vendor product statements; 761 omitted. Read the full vendor advisory.

  • python-tornado-0:6.5.10-1.el10_2.1.src as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2.1?arch=src

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.
    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • python-tornado-debugsource-0:6.5.10-1.el10_2.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2.1?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.
    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • python3-tornado-0:6.5.10-1.el10_2.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2.1?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.
    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • python3-tornado-debuginfo-0:6.5.10-1.el10_2.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2.1?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.
    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • python-tornado-debugsource-0:6.5.10-1.el9_8.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8.1?arch=s390x

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.
    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • python3-tornado-0:6.5.10-1.el9_8.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8.1?arch=s390x

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.
    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • python3-tornado-debuginfo-0:6.5.10-1.el9_8.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8.1?arch=s390x

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.
    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • registry.redhat.io/ansible-automation-platform-26/lightspeed-chatbot-rhel9@sha256:d4c2821fb38e6302a9619334680e0666013ea61f0a24e8995c78b2d2ae681c4c_arm64 as a component of Red Hat Ansible Automation Platform 2.6 · fixed

    Vendor assessment for this product only.

    pkg:oci/lightspeed-chatbot-rhel9@sha256%3Ad4c2821fb38e6302a9619334680e0666013ea61f0a24e8995c78b2d2ae681c4c?arch=arm64&repository_url=registry.redhat.io/ansible-automation-platform-26/lightspeed-chatbot-rhel9&tag=1791978798

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade Vendor guidance
    • workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.
    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:1ddd567dacafb048d99459bc862b1cc0cf8e55c8d96c859f6caa81e3e54c730c_amd64 as a component of Red Hat OpenShift AI 2.25 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-feature-server-rhel9@sha256%3A1ddd567dacafb048d99459bc862b1cc0cf8e55c8d96c859f6caa81e3e54c730c?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-feature-server-rhel9&tag=1792148523

    • vendor fix: For Red Hat OpenShift AI 2.25.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.
    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:4889829051aba21ec882d8c8912d63494ad9b663102ba441b3ad4cef296b97b7_amd64 as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-feature-server-rhel9@sha256%3A4889829051aba21ec882d8c8912d63494ad9b663102ba441b3ad4cef296b97b7?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-feature-server-rhel9&tag=1791863220

    • vendor fix: For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.
    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • registry.redhat.io/rhoai/odh-trustyai-nemo-guardrails-server-rhel9@sha256:cb78838fe6b5935912b000b04706a1f4536080f1db4e6dd44a17ff1dc2f7995e_amd64 as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-trustyai-nemo-guardrails-server-rhel9@sha256%3Acb78838fe6b5935912b000b04706a1f4536080f1db4e6dd44a17ff1dc2f7995e?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-trustyai-nemo-guardrails-server-rhel9&tag=1791556128

    • vendor fix: For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.
    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • lightspeed-core/lightspeed-stack-rhel9 as a component of Lightspeed Core · known affected

    Vendor assessment for this product only.

    pkg:oci/lightspeed-stack-rhel9@sha256:4094c9b5601983497b2dac5f0e6b3e1cb8e6094eaab30f05d0a7a535a49c179c?repository_url=registry.redhat.io/lightspeed-core/lightspeed-stack-rhel9

    • workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.
    • none available: Affected
    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • rhelai3/bootc-gaudi-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-gaudi-rhel9@sha256:e1057b59ca1be9501332abf97230855e85c7df858356be0da9dce230ea7e98e1?repository_url=registry.redhat.io/rhelai3/bootc-gaudi-rhel9

    • workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-pipeline-runtime-minimal-cpu-py312-rhel9@sha256:b65cee70b3abfa45f0e8ed4763f5c55fb48b75410184065b95b429b2b0a4717f?repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9

    • workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.
    • none available: Affected
    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9@sha256:8d61dd22d1adf0fd7df80a65783e01fc6226e98f14a3ebde9bd5388dd9d21beb?repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9

    • workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.
    • none available: Affected
    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • rhoai/odh-th06-cuda130-torch210-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-th06-cuda130-torch210-py312-rhel9@sha256:7f4c4a15b24a0a538de526f305286262bf9784fe7695efae0db3519735deaba4?repository_url=registry.redhat.io/rhoai/odh-th06-cuda130-torch210-py312-rhel9

    • workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.
    • none available: Affected
    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-workbench-jupyter-minimal-cpu-py312-rhel9@sha256:1e8c79265d905315b4e9e11185f8abac06823eb2441bc4e7466bad4e48c84f16?repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9

    • workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.
    • none available: Affected
    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-workbench-jupyter-pytorch-rocm-py312-rhel9@sha256:0708626cd3b96dfb6a7bef4085872dc131b64340112c40f7c70e7139882e5412?repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9

    • workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.
    • none available: Affected
    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • rhosp-rhel8/openstack-cinder-backup as a component of Red Hat OpenStack Platform 16.2 · known affected

    Vendor assessment for this product only.

    pkg:oci/openstack-cinder-backup@sha256:2ea0f1758551777be62b1c42c4f23b2fee1e172cf8e5bfb7986bcae3fd940e22?repository_url=registry.redhat.io/rhosp-rhel8/openstack-cinder-backup

    • workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.
    • none available: Affected
    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • rhosp-rhel8/openstack-ovn-northd as a component of Red Hat OpenStack Platform 16.2 · known affected

    Vendor assessment for this product only.

    pkg:oci/openstack-ovn-northd@sha256:2022f438013b066b8d02b4d568b4549dfc725c88291cd7e6ba0441c42e39e234?repository_url=registry.redhat.io/rhosp-rhel8/openstack-ovn-northd

    • workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.
    • none available: Affected
    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • rhosp-rhel9/openstack-haproxy as a component of Red Hat OpenStack Platform 17.1 · known affected

    Vendor assessment for this product only.

    pkg:oci/openstack-haproxy@sha256:f8e6031167299543d3dc6144b7203b2726394c1a00ec59de329de38f670da9c7?repository_url=registry.redhat.io/rhosp-rhel9/openstack-haproxy

    • workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.
    • none available: Affected
    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • rhosp-rhel9/openstack-redis as a component of Red Hat OpenStack Platform 17.1 · known affected

    Vendor assessment for this product only.

    pkg:oci/openstack-redis@sha256:8096c9e75e718782eaf27f1c8375af14a13446245c2cc4ab9b5a59e4cf8f46fc?repository_url=registry.redhat.io/rhosp-rhel9/openstack-redis

    • workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.
    • none available: Affected
    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:105ae98f9f09b478e0187f6a02e364e075b7b7389ec0f423f60929f0e1ebf6a8_amd64 as a component of Red Hat Ansible Automation Platform 2.6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/aap-must-gather-rhel9@sha256%3A105ae98f9f09b478e0187f6a02e364e075b7b7389ec0f423f60929f0e1ebf6a8?arch=amd64&repository_url=registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9&tag=1791938867

    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • registry.redhat.io/ansible-automation-platform-26/lightspeed-rhel9@sha256:82f4722e1870fa651fc86de51bf5cee77384d1c6df28f0d011dae3c599266f73_ppc64le as a component of Red Hat Ansible Automation Platform 2.6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/lightspeed-rhel9@sha256%3A82f4722e1870fa651fc86de51bf5cee77384d1c6df28f0d011dae3c599266f73?arch=ppc64le&repository_url=registry.redhat.io/ansible-automation-platform-26/lightspeed-rhel9&tag=1791898403

    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • registry.redhat.io/ansible-automation-platform-27/lightspeed-rhel9-operator@sha256:8cca3f06ea3f9d0e25048e196d6627d2688613955be4dd2c313b3acda4713505_amd64 as a component of Red Hat Ansible Automation Platform 2.7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/lightspeed-rhel9-operator@sha256%3A8cca3f06ea3f9d0e25048e196d6627d2688613955be4dd2c313b3acda4713505?arch=amd64&repository_url=registry.redhat.io/ansible-automation-platform-27/lightspeed-rhel9-operator&tag=1792138238

    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • registry.redhat.io/rhoai/odh-kueue-controller-rhel9@sha256:d6edef24c15ae414b8b34b8bd202a6abe7208e99f47bf7e4d64b6ac1e70c6f3d_ppc64le as a component of Red Hat OpenShift AI 2.25 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-kueue-controller-rhel9@sha256%3Ad6edef24c15ae414b8b34b8bd202a6abe7208e99f47bf7e4d64b6ac1e70c6f3d?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-kueue-controller-rhel9&tag=1791854046

    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • registry.redhat.io/rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9@sha256:65864c015c8e236b8805c0ec5ed635ee5915c2c9b9350dc227fa96a064fff85f_s390x as a component of Red Hat OpenShift AI 2.25 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-pipeline-runtime-minimal-cpu-py312-rhel9@sha256%3A65864c015c8e236b8805c0ec5ed635ee5915c2c9b9350dc227fa96a064fff85f?arch=s390x&repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9&tag=1791393968

    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • registry.redhat.io/rhoai/odh-autorag-rhel9@sha256:e2052cdc42978bf2c18fedf1e5c16c5870a85d2f6b59fdbd739ea909c31afb6c_s390x as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-autorag-rhel9@sha256%3Ae2052cdc42978bf2c18fedf1e5c16c5870a85d2f6b59fdbd739ea909c31afb6c?arch=s390x&repository_url=registry.redhat.io/rhoai/odh-autorag-rhel9&tag=1791557539

    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • registry.redhat.io/rhoai/odh-llm-d-batch-gateway-apiserver-rhel9@sha256:a1283f6682e58a0a8ad2e06d200ea487217e597ae3d56ac0c821be77f297ca66_s390x as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-llm-d-batch-gateway-apiserver-rhel9@sha256%3Aa1283f6682e58a0a8ad2e06d200ea487217e597ae3d56ac0c821be77f297ca66?arch=s390x&repository_url=registry.redhat.io/rhoai/odh-llm-d-batch-gateway-apiserver-rhel9&tag=1791510014

    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • registry.redhat.io/rhoai/odh-mod-arch-mlflow-rhel9@sha256:eaeec299cda37de214ba2a7a0437ac02407577c523122de77a2727531e980f8b_ppc64le as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-mod-arch-mlflow-rhel9@sha256%3Aeaeec299cda37de214ba2a7a0437ac02407577c523122de77a2727531e980f8b?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-mod-arch-mlflow-rhel9&tag=1791861383

    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • registry.redhat.io/rhoai/odh-ta-lmes-job-rhel9@sha256:a6a0c57a602d5a62517c585e0a50daf93f942bbfe6af7f7a19d9e837919bbef2_amd64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-ta-lmes-job-rhel9@sha256%3Aa6a0c57a602d5a62517c585e0a50daf93f942bbfe6af7f7a19d9e837919bbef2?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-ta-lmes-job-rhel9&tag=1791470318

    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00
  • python-tornado.src as a component of Red Hat OpenShift Container Platform 4 · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-103262 · Updated 2026-10-22T05:23:13+00:00

All CVSS metrics

  • HIGH 8.7 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • HIGH 7.5 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • HIGH 8.7 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • HIGH 7.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Exploit-tagged references (not proof of a PoC)

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS