In Tornado versions prior to 6.5.5 the server parses multipart/form-data synchronously on the main thread with only the max_body_size setting as a limit (default 100 MB). A request containing many individual parts can therefore consume excessive CPU and memory during parsing, causing the application to become unresponsive. The vulnerability is a classic resource exhaustion flaw (CWE‑400 and CWE‑770).

The affected vendor is Tornado (tornadoweb:tornado). All releases up to and including 6.5.4 are vulnerable; the issue is resolved starting with Tornado 6.5.5.

The CVSS score of 8.7 indicates serious severity, but the EPSS score of less than 1 % suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, and no public exploit has been reported. The likely attack vector is remote HTTP requests with large multipart bodies; however, direct evidence of an existing exploitation path is not provided in the data.