Vulnerability · Published Oct 1, 2026 · Assigned by VulnCheck
CVE-2026-103261Tornado before 6.5.9 Denial of Service via Query String
Medium 5.3
In plain English
A medium-severity resource allocation without limits in tornado from tornadoweb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts to degrade response times for all clients sharing the same IOLoop.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-tornado | no fix listed | DEBIAN-CVE-2026-103261 |
| Debian:13 | python-tornado | no fix listed | DEBIAN-CVE-2026-103261 |
| Debian:14 | python-tornado | no fix listed | DEBIAN-CVE-2026-103261 |
| PyPI | tornado | 6.5.9 | GHSA-3hv7-mjh2-fv65 |
| Ubuntu:24.04:LTS | python-tornado | no fix listed | UBUNTU-CVE-2026-103261 |
| Ubuntu:26.04:LTS | python-tornado | no fix listed | UBUNTU-CVE-2026-103261 |
| Ubuntu:26.10 | python-tornado | no fix listed | UBUNTU-CVE-2026-103261 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tornadoweb | tornado | 0 – before 6.5.9 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L