PT-2026-103794

CVE-2026-103261

Published

2026-09-30

Updated

2026-10-02

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.5.9

Description The software fails to limit the number of query string fields in the HTTPServerRequest. init function. This allows remote, unauthenticated attackers to send GET requests containing thousands of query parameters, leading to event-loop stalling. This condition degrades response times for all clients sharing the same IOLoop, which is the main event loop that handles all asynchronous networking tasks in the application.

Recommendations Update to version 6.5.9 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Iaohkut-From-Nightwolf-Team

Manus-Pi

Vendors

Affected products

Weakness enumeration

CWE-770: Allocation of Resources Without Limits or Throttling