Skip to main content

Tornado CVE-2026-91990

| EUVDEUVD-2026-78661 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-09-15 VulnCheck GHSA-wwvv-qf38-wpf3
Denial Of Service Red Hat Suse Tornado Tornadoweb
8.7
CVSS 4.0 · Vendor: VulnCheck
View

Vulnerability Assessment

Weakness
CWE
CWE-770
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 15, 2026

Memory amplification denial of service in the Tornado Python web framework before 6.5.8 lets unauthenticated remote attackers exhaust server memory with a single crafted multipart/form-data request containing tens of thousands of parts — roughly 600KB of body is enough to build a 100,000-element transient list. Tornado's parse_multipart_form_data splits the body on the boundary before it enforces the max_parts limit, so the safety check fires only after the expensive allocation has already happened. Publicly available exploit code exists (a gist with poc.py), patch status is 'available from vendor' with the fix shipped in 6.5.8, and no CISA KEV listing or EPSS score accompanied the supplied intelligence.

Affected VersionsENISA

Tornado 0 <6.5.8

Affected Packages

pypi tornado fix: 6.5.8

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Tornado gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.5 HIGH

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch available
Sep 15, 2026 - 16:03 EUVD
CVE Published
Sep 15, 2026 - 15:18 cve.org
HIGH 8.7

DescriptionCVE.org

Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 9 pypi packages depend on tornado (6 direct, 3 indirect)

Ecosystem-wide dependent count for version 6.5.8.

Technical POC Analysis

Note on provenance: the text below is grounded in GHSA-8423-8fgw-73vq.

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Sign in to read

Threat Intelligence Overview

EPSS Score
0.4%
Top 65% exploitable
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.4%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Tornado

View all
CVE-2024-42733 CRITICAL POC
9.8 Mar 07

An issue in Docmosis Tornado v.2.9.7 and before allows a remote attacker to execute arbitrary code via a crafted script

CVE-2023-25266 HIGH POC
8.8 Feb 28

An issue was discovered in Docmosis Tornado prior to version 2.9.5. Rated high severity (CVSS 8.8), this vulnerability i
CVE-2025-67726 HIGH POC
7.5

py3-tornado in Alpine Linux received a security fix packaged as version 6.5.4-r0, addressing an unspecified vulnerabilit
CVE-2023-25265 HIGH POC
7.5 Feb 28

Docmosis Tornado <= 2.9.4 is vulnerable to Directory Traversal leading to the disclosure of arbitrary content on the fil
CVE-2023-25264 HIGH POC
7.5 Feb 28

An issue was discovered in Docmosis Tornado prior to version 2.9.5. Rated high severity (CVSS 7.5), this vulnerability i
CVE-2026-116577 MEDIUM POC
5.3 Oct 26

Tornado's HTTP/1.x header parser consumes quadratic CPU time when a header value is spread across many obsolete line-fol
CVE-2026-103262 HIGH
8.7 Oct 01

Denial of service in the Tornado web framework's CurlAsyncHTTPClient (all releases before 6.5.9) lets an unauthenticated
CVE-2026-31958 HIGH
8.7 Mar 11

In versions of Tornado prior to 6.5.5, the only limit on the number of parts in `multipart/form-data` is the `max_body_s
CVE-2026-91992 HIGH
8.2 Sep 15

Credential leakage in Tornado's CurlAsyncHTTPClient (all releases through 6.5.6) lets sensitive per-request state — clie
CVE-2026-103263 HIGH
8.2 Oct 01

Unauthenticated local file disclosure in Tornado before 6.5.9 lets remote attackers read files outside a configured stat
CVE-2026-82397 HIGH
7.5 Aug 31

Denial-of-service in Tornado prior to 6.5.8 allows unauthenticated remote attackers to stall the entire server by sendin
CVE-2025-67725 HIGH
7.5

Tornado Python web framework on Alpine Linux received a security fix in package version 6.5.4-r0, addressing an uncharac

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2024-28182 MEDIUM
5.3
CVE-2023-2650 MEDIUM
6.5
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2022-32206 MEDIUM POC
6.5
CVE-2023-24998 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected

References

Advisories & patches
ADVISORY https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-91990 ADVISORY https://ubuntu.com/security/notices/USN-8952-1 ADVISORY https://vuldb.com/vuln/404308 REF https://www.vulncheck.com/advisories/tornado-before-6.5.8-memory-amplification-dos-via-multipart

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy