EUVD-2026-78661
GHSA-wwvv-qf38-wpf3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.
AnalysisAI
Memory amplification denial of service in the Tornado Python web framework before 6.5.8 lets unauthenticated remote attackers exhaust server memory with a single crafted multipart/form-data request containing tens of thousands of parts — roughly 600KB of body is enough to build a 100,000-element transient list. Tornado's parse_multipart_form_data splits the body on the boundary before it enforces the max_parts limit, so the safety check fires only after the expensive allocation has already happened. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue in Docmosis Tornado v.2.9.7 and before allows a remote attacker to execute arbitrary code via a crafted script
An issue was discovered in Docmosis Tornado prior to version 2.9.5. Rated high severity (CVSS 8.8), this vulnerability i
Docmosis Tornado <= 2.9.4 is vulnerable to Directory Traversal leading to the disclosure of arbitrary content on the fil
An issue was discovered in Docmosis Tornado prior to version 2.9.5. Rated high severity (CVSS 7.5), this vulnerability i
In versions of Tornado prior to 6.5.5, the only limit on the number of parts in `multipart/form-data` is the `max_body_s
Credential leakage in Tornado's CurlAsyncHTTPClient (all releases through 6.5.6) lets sensitive per-request state — clie
Denial-of-service in Tornado prior to 6.5.8 allows unauthenticated remote attackers to stall the entire server by sendin
Tornado is a Python web framework and asynchronous networking library. Rated high severity (CVSS 7.5), this vulnerabilit
Tornado 6.5.5 through 6.5.7 allows attackers to inject arbitrary Set-Cookie attributes because the fix for CVE-2026-3553
Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a
Cookie attribute injection in Tornado web framework versions before 6.5.5 allows unauthenticated remote attackers to man
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today