Description
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.
Published: 2026-08-31
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from Tornado’s use of urllib.parse.parse_qs without specifying max_num_fields, allowing an unauthenticated HTTP request containing millions of separator‑delimited fields to occupy the event loop and stall all connections. The missing guard corresponds to CWE-1284 and CWE-400, and the CVSS score of 7.5 indicates a high severity.

Affected Systems

All deployments of Tornado Web running any version prior to 6.5.8 are affected. The issue was fixed in release 6.5.8, which now enforces a limit on the number of form fields during body parsing.

Risk and Exploitability

The exploit requires only a large urlencoded body from an external client and does not require authentication or elevated privileges. Though the EPSS score is not available and the vulnerability is not yet listed in the CISA KEV catalog, the single‑threaded event loop can be blocked by a single malicious request, placing the risk at moderate to high.

Generated by OpenCVE AI on August 31, 2026 at 22:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Tornado 6.5.8 release or later, which enforces max_num_fields on body parsing.
  • If an upgrade is not possible, use a reverse proxy or application configuration to reject bodies exceeding a safe size and set a bounded max_buffer_size, and manually enforce a limit on the number of query parameters before Tornado processes them.
  • As a temporary measure, modify request handlers to pre‑validate the body length or count fields and return a 400 response before the event loop is overwhelmed.

Generated by OpenCVE AI on August 31, 2026 at 22:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Tornadoweb
Tornadoweb tornado
Vendors & Products Tornadoweb
Tornadoweb tornado

Mon, 31 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Description Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.
Title Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
Weaknesses CWE-1284
CWE-400
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Tornadoweb Tornado
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-31T21:28:13.958Z

Reserved: 2026-08-28T22:00:43.512Z

Link: CVE-2026-82397

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-31T22:17:22.920

Modified: 2026-08-31T22:17:22.920

Link: CVE-2026-82397

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T23:00:12Z

Weaknesses
  • CWE-1284

    Improper Validation of Specified Quantity in Input

  • CWE-400

    Uncontrolled Resource Consumption