Executive brief
Tornado, a Python web framework used to build real-time web applications, contains a vulnerability in its multipart form data parser. An unauthenticated attacker can send specially crafted HTTP requests with many form fields that cause the server to allocate excessive memory, leading to service disruption or denial of service. No user interaction is required, and the attack can be launched over the network against any exposed Tornado application.
Technical details
The vulnerability exists in the parse_multipart_form_data function in httputil.py, where the code calls data.split() on multipart form data before validating the max_parts configuration limit. The split() operation creates a large transient list in memory before the validation check occurs, allowing memory amplification. An attacker can send a small HTTP body (e.g., 600 KB) with many parts (e.g., 100,000) to force the creation of a similarly large in-memory list, exhausting server memory and causing denial of service. This is a pre-authentication network-based attack. The fix involves counting the boundary delimiters without materializing the split list (e.g., using data.count() instead of split()). Tornado 6.5.8 and later patch this issue.
Affected products
- Tornado Tornado before 6.5.8
Timeline
- 2026-08-07: disclosed: GitHub Security Advisory (GHSA-8423-8fgw-73vq) published
- 2026: patched: Fixed in Tornado 6.5.8
- 2026-09-15: advisory: CVE-2026-91990 published