Denial-of-Service Risk in Tornado Python Web Framework and Asynchronous Library

CVE-2026-82397

What is CVE-2026-82397?

The Tornado web framework contains a vulnerability where it improperly processes application/x-www-form-urlencoded request bodies. Versions prior to 6.5.8 utilize urllib.parse.parse_qs without a limit on the number of fields, resulting in the possibility of an unauthenticated request body with excessive fields that can stall the single-threaded event loop. This could lead to performance degradation, as the server’s ability to handle connections is severely impacted. The issue is mitigated in version 6.5.8, where the handling of request bodies includes appropriate limitations to prevent such stalls.

References