Skip to main content

Tornado CVE-2026-31958

HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-03-11 security-advisories@github.com GHSA-qjxf-f2mg-c6mc
Denial Of Service Python Red Hat Suse Tornado Tornadoweb
8.7
CVSS 4.0 · GitHub Advisory
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send multipart/form-data request with many parts
  2. Exploit
    Parser processes synchronously on main thread
  3. Impact
    CPU exhaustion causes denial-of-service

Vulnerability Assessment

Weakness
CWE
CWE-400
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Tornado versions prior to 6.5.5 with multipart/form-data parsing enabled. No authentication required. Remote attacker sends crafted multipart request with excessive parts within max_body_size limit (default 100MB).
Impact

Service disruption affecting availability. In critical infrastructure, DoS can have cascading effects on dependent systems.
Exploit ScenarioDerived

An attacker sends specially crafted requests that cause excessive resource consumption (CPU, memory, disk) or trigger a crash in the target application.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts.

Tornado 6.5.5 introduces new limits on the size and complexity of multipart bodies, including a default limit of 100 parts per request. These limits are configurable if needed; see tornado.httputil.ParseMultipartConfig. It is also now possible to disable multipart/form-data parsing entirely if it is not required for the application.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 22:07 CVSS 8.7

RemediationAI

A vendor patch is available — apply it immediately. Implement rate limiting and input validation. Use timeout mechanisms for resource-intensive operations. Deploy DDoS protection where applicable.

Affected Packages

pypi tornado fix: 6.5.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

A denial of service vulnerability allows an attacker to disrupt the normal functioning of a system, making it unavailable to legitimate users. This vulnerability is classified as Uncontrolled Resource Consumption (CWE-400).

Know when Tornado gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.3 MEDIUM

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Mar 11, 2026 - 20:16 nvd
HIGH 8.7

DescriptionGitHub Advisory

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 23 pypi packages depend on tornado (15 direct, 8 indirect)

Ecosystem-wide dependent count for version 6.5.5.

Threat Intelligence Overview

EPSS Score
0.0%
Top 85% exploitable
Threat Intel
1
1 source
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact· derived
Medium

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)GitHub Advisory

cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:*

More in Tornado

View all
CVE-2024-42733 CRITICAL POC
9.8 Mar 07

An issue in Docmosis Tornado v.2.9.7 and before allows a remote attacker to execute arbitrary code via a crafted script

CVE-2023-25266 HIGH POC
8.8 Feb 28

An issue was discovered in Docmosis Tornado prior to version 2.9.5. Rated high severity (CVSS 8.8), this vulnerability i
CVE-2025-67726 HIGH POC
7.5

py3-tornado in Alpine Linux received a security fix packaged as version 6.5.4-r0, addressing an unspecified vulnerabilit
CVE-2023-25265 HIGH POC
7.5 Feb 28

Docmosis Tornado <= 2.9.4 is vulnerable to Directory Traversal leading to the disclosure of arbitrary content on the fil
CVE-2023-25264 HIGH POC
7.5 Feb 28

An issue was discovered in Docmosis Tornado prior to version 2.9.5. Rated high severity (CVSS 7.5), this vulnerability i
CVE-2026-116577 MEDIUM POC
5.3 Oct 26

Tornado's HTTP/1.x header parser consumes quadratic CPU time when a header value is spread across many obsolete line-fol
CVE-2026-103262 HIGH
8.7 Oct 01

Denial of service in the Tornado web framework's CurlAsyncHTTPClient (all releases before 6.5.9) lets an unauthenticated
CVE-2026-91990 HIGH
8.7 Sep 15

Memory amplification denial of service in the Tornado Python web framework before 6.5.8 lets unauthenticated remote atta
CVE-2026-91992 HIGH
8.2 Sep 15

Credential leakage in Tornado's CurlAsyncHTTPClient (all releases through 6.5.6) lets sensitive per-request state — clie
CVE-2026-103263 HIGH
8.2 Oct 01

Unauthenticated local file disclosure in Tornado before 6.5.9 lets remote attackers read files outside a configured stat
CVE-2026-82397 HIGH
7.5 Aug 31

Denial-of-service in Tornado prior to 6.5.8 allows unauthenticated remote attackers to stall the entire server by sendin
CVE-2025-67725 HIGH
7.5

Tornado Python web framework on Alpine Linux received a security fix in package version 6.5.4-r0, addressing an uncharac

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:8093 ADVISORY https://ubuntu.com/security/notices/USN-8198-1 ADVISORY https://vuldb.com/?id.350548 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1064/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1162/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1171/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20761/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20770/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20797/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20919/ REF https://github.com/tornadoweb/tornado/security/advisories/GHSA-qjxf-f2mg-c6mc REF https://lists.debian.org/debian-lts-announce/2026/04/msg00000.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy