Executive brief
Tornado, a popular Python web application framework, fails to limit the number of form fields parsed from HTTP POST requests with urlencoded bodies. An attacker can craft a malicious POST request with a body consisting almost entirely of field separators, creating tens of millions of fields. Because parsing occurs on the main event loop before request handling, a single request stalls the entire server and blocks all other clients from being served.
Technical details
The vulnerability exists in tornado/escape.py, where urllib.parse.parse_qs() is called without the max_num_fields parameter introduced in CPython to prevent ReDoS-style attacks. A malicious client sends an HTTP POST request with Content-Type: application/x-www-form-urlencoded and a body up to 100 MB consisting primarily of field separators ('&' characters). This generates approximately 50 million fields. The parsing occurs synchronously in tornado/web.py during RequestHandler._execute before user code runs, blocking the single-threaded event loop. All concurrent connections wait indefinitely, creating a complete denial of service. The attack requires no authentication if any route accepts form data (standard for web apps). The fix is to pass max_num_fields to parse_qs with a conservative default, allowing applications to raise the limit if needed. Patched in version 6.5.8.
Affected products
- tornadoweb tornado <= 6.5.7
Timeline
- 2026-08-07: disclosed: Security advisory published to GitHub Advisory Database
- 2026-08-07: patched: Fix released in version 6.5.8