CVE-2026-82397

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.5.8

Description Tornado parses application/x-www-form-urlencoded request bodies using urllib.parse.parse qs in tornado/escape.py without specifying the max num fields parameter. The process occurs within RequestHandler. execute in tornado/web.py, which parses the body via HTTPServerRequest. parse body and parse body arguments in tornado/httputil.py before handler dispatch. Consequently, an unauthenticated request containing millions of separator-delimited fields can synchronously stall the single-threaded event loop, delaying all active connections. The request body is only limited by max buffer size, which defaults to 104857600 bytes.

Recommendations Update to version 6.5.8.