Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pcs-snmpUpgrade pcsUpgrade python3-tornado | Apr 17, 2026 | Apr 14, 2026 |
| Amazon Linux Ami 2 | — | Upgrade python-tornado-docUpgrade python-tornadoUpgrade python-tornado-debuginfoUpgrade python3-tornadoUpgrade python3-tornado-docUpgrade python3-tornado-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade python-tornado-docUpgrade python3-tornado-debuginfoUpgrade python3.13-tornado-debuginfoUpgrade python3.13-tornado-debugsourceUpgrade python3.13-tornadoUpgrade python3.13-tornado-docUpgrade python-tornado-debugsourceUpgrade python3-tornado | Apr 7, 2026 | Mar 11, 2026 |
| Debian | — | Upgrade python-tornado | Apr 2, 2026 | Apr 2, 2026 |
| Oracle_linux | — | Upgrade pcsUpgrade python3-tornadoUpgrade pcs-snmp | Apr 22, 2026 | Mar 11, 2026 |
| Redhat_linux | — | Upgrade python3-tornadoNo solution existsUpgrade python3-tornado-debuginfoUpgrade python-tornado-docUpgrade pcs-snmpUpgrade python-tornado-debuginfoUpgrade python-tornadoUpgrade python-tornado-debugsourceUpgrade pcs | Apr 15, 2026 | Mar 11, 2026 |
| Rocky_linux | — | Upgrade python3-tornadoUpgrade pcs-snmpUpgrade python-tornado-debugsourceUpgrade python3-tornado-debuginfoUpgrade pcs | Apr 17, 2026 | Apr 16, 2026 |
| Ubuntu | — | Upgrade python3-tornadoUpgrade python3-tornado (Ubuntu Pro)Upgrade python-tornado (Ubuntu Pro) | Apr 23, 2026 | Mar 11, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Mar 11, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub