Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pcs-snmpUpgrade pcs | Jan 26, 2026 | Jan 21, 2026 |
| Alpine Linux | — | Upgrade py3-tornado | Jun 18, 2026 | Dec 12, 2025 |
| Amazon Linux Ami 2 | — | Upgrade python3-tornado-debuginfoUpgrade python-tornado-docUpgrade python3-tornadoUpgrade python-tornadoUpgrade python-tornado-debuginfoUpgrade python3-tornado-doc | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade python3.13-tornado-docUpgrade python-tornado-docUpgrade python3.13-tornado-debuginfoUpgrade python3-tornadoUpgrade python3-tornado-debuginfoUpgrade python3.13-tornadoUpgrade python-tornado-debugsourceUpgrade python3.13-tornado-debugsource | Jan 12, 2026 | Dec 12, 2025 |
| Debian | — | Upgrade python-tornado | Feb 2, 2026 | Feb 2, 2026 |
| Oracle_linux | — | Upgrade pcs-snmpUpgrade pcs | Jan 23, 2026 | Dec 12, 2025 |
| Redhat_linux | — | Upgrade pcs-snmpUpgrade pcsNo solution exists | Jan 22, 2026 | Dec 12, 2025 |
| Rocky_linux | — | Upgrade pcsUpgrade pcs-snmp | Jan 26, 2026 | Jan 23, 2026 |
| Ubuntu | — | Upgrade python3-tornado (Ubuntu Pro)Upgrade python3-tornadoUpgrade python-tornado (Ubuntu Pro) | Jan 9, 2026 | Dec 12, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub