PT-2026-103794 · Tornadoweb · Tornado

Iaohkut-From-Nightwolf-Team

+1

·

CVE-2026-103261

·

Publicado

2026-10-01

·

Atualizado

2026-10-01

CVSS v3.1

5.3

Média

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest. init , allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts to degrade response times for all clients sharing the same IOLoop.

Correção

Allocation of Resources Without Limits

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

CVE-2026-103261

Produtos afetados

Tornado