Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck
CVE-2026-91990Tornado before 6.5.8 Memory Amplification DoS via multipart
High 7.5
In plain English
A high-severity resource allocation without limits in tornado from tornadoweb. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | python3-tornado | 6.5.8-0.el10_2.1 | ALSA-2026:67147 |
| AlmaLinux:9 | python3-tornado | 6.5.8-0.el9_8.1 | ALSA-2026:67146 |
| Debian:12 | python-tornado | no fix listed | DEBIAN-CVE-2026-91990 |
| Debian:13 | python-tornado | no fix listed | DEBIAN-CVE-2026-91990 |
| Debian:14 | python-tornado | no fix listed | DEBIAN-CVE-2026-91990 |
| PyPI | tornado | 6.5.8 | GHSA-8423-8fgw-73vq |
| Ubuntu:24.04:LTS | python-tornado | 6.4.0-1ubuntu0.6 | USN-8952-1 |
| Ubuntu:24.04:LTS | python-tornado | 6.4.0-1ubuntu0.6 | UBUNTU-CVE-2026-91990 |
| Ubuntu:26.04:LTS | python-tornado | 6.5.4-0.1ubuntu0.2 | USN-8952-1 |
| Ubuntu:26.04:LTS | python-tornado | 6.5.4-0.1ubuntu0.2 | UBUNTU-CVE-2026-91990 |
| Ubuntu:26.10 | python-tornado | 6.5.5-5ubuntu1.1 | USN-8952-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tornadoweb | tornado | 0 – before 6.5.8 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory (GHSA-8423-8fgw-73vq) vendor-advisory
- VulnCheck Advisory: Tornado before 6.5.8 Memory Amplification DoS via multipart third-party-advisory