Junglewise Threat Intelligence

Tornado multipart form data memory amplification DoS in httputil.py

Severity: medium · CVSS 6.9 · Published 2026-09-01

Executive brief

Tornado's HTTP request handler performs an expensive string split operation on multipart form data before validating the number of parts, allowing an attacker to trigger unbounded memory allocation and CPU consumption via a specially crafted HTTP POST request. A 600KB malicious request can force the server to allocate memory for 100,000+ list elements before rejecting the request, enabling a memory amplification denial-of-service attack without authentication.

Technical details

The vulnerability is a resource exhaustion flaw in the multipart form data parser (CWE-770: Allocation of Resources Without Limits or Throttling). The vulnerable code calls data.split(b"--"+boundary+b"\r\n") before checking if len(parts) > max_parts, creating a transient Python list containing all split elements as copies before the limit is enforced. An attacker can craft a POST request with a tiny boundary delimiter (e.g., "x") and a large body (~600KB–100MB) of repeated "q--x\r\n" patterns, forcing the parser to materialize millions of list entries. Even though the max_parts check rejects the request after the split, the memory and CPU have already been consumed. The attack is pre-authentication and requires only network access to send an HTTP POST request. The fix, deployed in Tornado 6.5.8, counts separators using data.count() before materializing the list, preventing transient allocation. Patch available in version 6.5.8 and later.

Affected products

  • Tornado Tornado <= 6.5.7

Timeline

  • 2026-07: disclosed: Reported by afldl
  • 2026-08-07: advisory: GitHub Advisory published
  • 2026-08-07: patched: Fix deployed in Tornado 6.5.8 (commit de85b3f)

References

Related threats