Is CVE-2026-103261 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103261 being exploited in the wild.

How severe is CVE-2026-103261?

Medium severity, with a CVSS score of 5.3, published 1 October 2026.

Which products and versions are affected?

tornado (PyPI) ECOSYSTEM:introduced=0,fixed=6.5.9; Tornado before 6.5.9.

How is CVE-2026-103261 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-103261?

Check whether you run tornado (PyPI) or Tornado at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103261: Tornado unbounded query string field parsing DoS

CVE-2026-103261 · Severity: medium · CVSS 5.3 · Published 2026-10-01

Tornado, a popular Python web framework, fails to limit the number of query string fields it parses, allowing attackers to send requests with thousands of parameters that consume excessive CPU time. An unauthenticated attacker can send a single malicious GET request to degrade response times for all other users sharing the same server instance, causing a denial of service.

Technologies: tornado (PyPI), Tornado. Vendors: PyPI, Tornado.

Quick answers

Is CVE-2026-103261 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103261 being exploited in the wild.
How severe is CVE-2026-103261?: Medium severity, with a CVSS score of 5.3, published 1 October 2026.
Which products and versions are affected?: tornado (PyPI) ECOSYSTEM:introduced=0,fixed=6.5.9; Tornado before 6.5.9.
Is there a fix for CVE-2026-103261?: Yes. tornado (PyPI): upgrade to 6.5.9 or later. Until then: If immediate upgrade is not possible, restrict max_header_size to prevent accumulating thousands of query parameters in a single request, or implement a reverse proxy that filters requests with excessive query string complexity.</anigation> <parameter name="timeline">[{"kind":"disclosed", "at":"2026-09-14"}, {"kind":"advisory", "at":"2026-10-01"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-103261 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-103261?: Check whether you run tornado (PyPI) or Tornado at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tornado (PyPI): upgrade to 6.5.9 or later
```
pip install "tornado>=6.5.9"
```

If immediate upgrade is not possible, restrict max_header_size to prevent accumulating thousands of query parameters in a single request, or implement a reverse proxy that filters requests with excessive query string complexity.</anigation> <parameter name="timeline">[{"kind":"disclosed", "at":"2026-09-14"}, {"kind":"advisory", "at":"2026-10-01"}]

Technical details

HTTPServerRequest.__init__ in tornado/httputil.py parses query strings via parse_qs_bytes() without enforcing a field-count limit, despite an identical POST-body parsing path having a max_num_fields=1000 cap added in the same release. Attackers can pack thousands of short key=value pairs into a ~64KB query string (fitting under max_header_size), triggering superlinear parsing cost synchronously in the event loop; a 7800-field query string takes ~25ms to parse versus 1.86ms for a normal request.

Affected products

Tornado Tornado before 6.5.9

Identifiers

CVE-2026-103261
GHSA-3hv7-mjh2-fv65

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.