PT-2026-24805 · Tornado+4 · Tornado+4
0X-Apollyon
+1
·
Published
2026-03-11
·
Updated
2026-06-08
·
CVE-2026-31958
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Tornado versions prior to 6.5.5
Description
Tornado is a Python web framework and asynchronous networking library. In versions prior to 6.5.5, the only limit on the number of parts in
multipart/form-data requests is the max body size setting, which defaults to 100MB. Because parsing of these requests occurs synchronously on the main thread, this can lead to a denial-of-service condition due to the computational cost of processing very large multipart bodies with numerous parts. Tornado 6.5.5 introduces new limits on the size and complexity of multipart bodies, including a default limit of 100 parts per request, configurable through tornado.httputil.ParseMultipartConfig. It is also possible to disable multipart/form-data parsing entirely if it is not required.Recommendations
Versions prior to 6.5.5 should be updated to version 6.5.5 or later.
Exploit
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Red Os
Rocky Linux
Tornado
Ubuntu