Is CVE-2026-91990 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91990 being exploited in the wild.

How severe is CVE-2026-91990?

High severity, with a CVSS score of 7.5, published 15 September 2026.

Which products and versions are affected?

tornado (PyPI) ECOSYSTEM:introduced=0,fixed=6.5.8.

Is there a fix for CVE-2026-91990?

Yes. tornado (PyPI): upgrade to 6.5.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-91990 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-91990?

Check whether you run tornado (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91990: Tornado memory amplification vulnerability in multipart form parsing

CVE-2026-91990 · Severity: high · CVSS 7.5 · Published 2026-09-15

Tornado, a Python web framework used to build real-time web applications, contains a vulnerability in its multipart form data parser. An unauthenticated attacker can send specially crafted HTTP requests with many form fields that cause the server to allocate excessive memory, leading to service disruption or denial of service. No user interaction is required, and the attack can be launched over the network against any exposed Tornado application.

Technologies: tornado (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-91990 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91990 being exploited in the wild.
How severe is CVE-2026-91990?: High severity, with a CVSS score of 7.5, published 15 September 2026.
Which products and versions are affected?: tornado (PyPI) ECOSYSTEM:introduced=0,fixed=6.5.8.
Is there a fix for CVE-2026-91990?: Yes. tornado (PyPI): upgrade to 6.5.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91990 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-91990?: Check whether you run tornado (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tornado (PyPI): upgrade to 6.5.8 or later
```
pip install "tornado>=6.5.8"
```

Technical details

The vulnerability exists in the parse_multipart_form_data function in httputil.py, where the code calls data.split() on multipart form data before validating the max_parts configuration limit. The split() operation creates a large transient list in memory before the validation check occurs, allowing memory amplification. An attacker can send a small HTTP body (e.g., 600 KB) with many parts (e.g., 100,000) to force the creation of a similarly large in-memory list, exhausting server memory and causing denial of service. This is a pre-authentication network-based attack. The fix involves counting the boundary delimiters without materializing the split list (e.g., using data.count() instead of split()). Tornado 6.5.8 and later patch this issue.

Affected products

Tornado Tornado before 6.5.8

Identifiers

CVE-2026-91990
GHSA-8423-8fgw-73vq

Timeline

2026-08-07: disclosed: GitHub Security Advisory (GHSA-8423-8fgw-73vq) published
2026: patched: Fixed in Tornado 6.5.8
2026-09-15: advisory: CVE-2026-91990 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.