Tornado EUVD-2026-90655

No special conditions - remote unauthenticated GET requests against default configurations of any Tornado HTTP server before 6.5.9 trigger the flaw, since HTTPServerRequest.__init__ parses the query string with no field-count limit by default. The only limiting factors are structural, not configuration-based: the query string is bounded by max_header_size (default 65536 bytes, ~7800 short fields per request), and impact is degradation rather than full denial, so an attacker must sustain multiple concurrent high-field requests to meaningfully stall the shared IOLoop. Multi-process/load-balanced deployments dilute the effect per worker; single-process internet-facing Tornado services are most exposed.

This is a genuine but low-to-moderate priority availability issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, low-complexity, unauthenticated exploitation requiring no user interaction, which makes it trivially reachable - but the impact is strictly VA:L (partial availability) with VC:N/VI:N, matching CWE-770 unbounded resource allocation and the description's 'degrade response times' / 'event-loop stalling' language. There is no confidentiality or integrity exposure and no full outage guaranteed, only degradation, so the vendor's 6.9 (4.0) score is driven entirely by easy reachability, not by severe impact. No EPSS score and no KEV listing were provided, and there is no evidence of active exploitation - exploitation status is 'no public exploit identified at time of analysis,' though the GHSA advisory documents a dynamic local reproduction against v6.5.8, so a working trigger is effectively trivial to construct. The attack is also self-limited: Tornado caps the request line plus headers at max_header_size (default 65536 bytes), so a single request carries at most a few thousand short fields (~7800), meaning an attacker must sustain many concurrent requests to meaningfully stall a shared IOLoop rather than achieve a one-shot crash. Net: real and easy to trigger, but bounded impact and no exploitation signals - patch during normal maintenance, prioritize higher for internet-facing single-process Tornado deployments.

An unauthenticated remote attacker sends GET requests whose query strings are packed with thousands of short key=value pairs (e.g. k0=1&k1=1&...&k7799=1, ~61KB, fitting under the 65536-byte header limit). Tornado parses each synchronously inside its single-threaded IOLoop with no field-count cap, so several such requests in flight burn CPU and delay processing of all other connections on that loop. The GHSA advisory includes a documented local reproduction against v6.5.8, but no weaponized public exploit tool was identified.