Vulnerability · Published Mar 11, 2026 · Assigned by GitHub_M
CVE-2026-31958Tornado has a DoS due to too many multipart parts
High 8.7
In plain English
A high-severity uncontrolled resource consumption in tornado from tornadoweb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | pcs | 0.10.18-2.el8_10.9.alma.1 | ALSA-2026:8093 |
| AlmaLinux:8 | pcs-snmp | 0.10.18-2.el8_10.9.alma.1 | ALSA-2026:8093 |
| AlmaLinux:10 | python3-tornado | 6.5.5-1.el10_1.1 | ALSA-2026:13641 |
| AlmaLinux:10 | python3-tornado | 6.5.5-1.el10_2 | ALSA-2026:19034 |
| AlmaLinux:9 | python3-tornado | 6.5.5-1.el9_7.1 | ALSA-2026:13670 |
| AlmaLinux:9 | python3-tornado | 6.5.5-1.el9_8 | ALSA-2026:19189 |
| Debian:12 | python-tornado | no fix listed | DEBIAN-CVE-2026-31958 |
| Debian:13 | python-tornado | no fix listed | DEBIAN-CVE-2026-31958 |
| Debian:14 | python-tornado | 6.5.5-1 | DEBIAN-CVE-2026-31958 |
| PyPI | tornado | 6.5.5 | GHSA-qjxf-f2mg-c6mc |
| PyPI | tornado | 6.5.5 | PYSEC-2026-140 |
| Rocky Linux:8 | pcs | 0:0.10.18-2.el8_10.9 | RLSA-2026:8093 |
| Rocky Linux:10 | python-tornado | 0:6.5.5-1.el10_1.1 | RLSA-2026:13641 |
| Rocky Linux:10 | python-tornado | 0:6.5.5-1.el10_1.1 | RLSA-2026:19034 |
| Rocky Linux:9 | python-tornado | 0:6.5.5-1.el9_7.1 | RLSA-2026:19189 |
| Rocky Linux:9 | python-tornado | 0:6.5.5-1.el9_7.1 | RLSA-2026:13670 |
| Ubuntu:24.04:LTS | python-tornado | 6.4.0-1ubuntu0.5 | UBUNTU-CVE-2026-31958 |
| Ubuntu:25.10 | python-tornado | 6.4.2-3ubuntu0.3 | UBUNTU-CVE-2026-31958 |
| Ubuntu:26.04:LTS | python-tornado | 6.5.4-0.1ubuntu0.1 | UBUNTU-CVE-2026-31958 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tornadoweb | tornado | < 6.5.5 |
Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N