Vulnerability · Published Aug 31, 2026 · Assigned by GitHub_M
CVE-2026-82397Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
High 7.5
In plain English
A high-severity uncontrolled resource consumption in tornado from tornadoweb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | pcs | 0.10.18-2.el8_10.10.alma.1 | ALSA-2026:84798 |
| AlmaLinux:8 | pcs-snmp | 0.10.18-2.el8_10.10.alma.1 | ALSA-2026:84798 |
| AlmaLinux:10 | python3-tornado | 6.5.8-0.el10_2.1 | ALSA-2026:67147 |
| AlmaLinux:9 | python3-tornado | 6.5.8-0.el9_8.1 | ALSA-2026:67146 |
| Debian:12 | python-tornado | no fix listed | DEBIAN-CVE-2026-82397 |
| Debian:13 | python-tornado | no fix listed | DEBIAN-CVE-2026-82397 |
| Debian:14 | python-tornado | no fix listed | DEBIAN-CVE-2026-82397 |
| PyPI | tornado | 6.5.8 | GHSA-mpf4-983q-p7j4 |
| PyPI | tornado | 6.5.8 | PYSEC-2026-3928 |
| Rocky Linux:8 | pcs | 0:0.10.18-2.el8_10.10 | RLSA-2026:84798 |
| Ubuntu:24.04:LTS | python-tornado | no fix listed | UBUNTU-CVE-2026-82397 |
| Ubuntu:26.04:LTS | python-tornado | no fix listed | UBUNTU-CVE-2026-82397 |
| Ubuntu:26.10 | python-tornado | no fix listed | UBUNTU-CVE-2026-82397 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tornadoweb | tornado | < 6.5.8 |
Weakness: CWE-400, CWE-1284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-mpf4-983q-p7j4 x_refsource_CONFIRM
- https://github.com/tornadoweb/tornado/pull/3704 x_refsource_MISC
- https://github.com/tornadoweb/tornado/commit/8d6363ed7b69d5f0da806efe34d256627a2191de x_refsource_MISC
- https://github.com/tornadoweb/tornado/releases/tag/v6.5.8 x_refsource_MISC