Vulnerability in tornadoweb tornado

[ Description ]Official description

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund19 Oct 2026WID-SEC-2026-4029

  Red Hat Enterprise Linux (python-tornado, resteasy-core, bubblewrap, pgvector): Multiple vulnerabilities Translated from German

  Risk highCVE-2026-89059CVE-2026-82397CVE-2026-87766+3 more CVEs
• CERT-FR25 Sep 2026CERTFR-2026-AVI-1233

  Multiple vulnerabilities in IBM products Translated from French

  Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, remote denial of service and a breach of data confidentiality.

  CVE-2021-44906CVE-2026-59651CVE-2026-6402+183 more CVEs

[ References ]References

• github.com/tornadoweb/tornado/security/advisories/GHSA-mpf4-983q-p7j4x_refsource_CONFIRM
• github.com/tornadoweb/tornado/pull/3704x_refsource_MISC
• github.com/tornadoweb/tornado/commit/8d6363ed7b69d5f0da806efe34d256627a2191dex_refsource_MISC
• github.com/tornadoweb/tornado/releases/tag/v6.5.8x_refsource_MISC