CVE-2026-82397

Received Received - Intake

Memory Exhaustion in Tornado Web Framework

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-82397

Affected Vendors & Products

Vendor	Product	Version / Range
twisted	tornado	6.5.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1284	The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

Tornado before 6.5.8 has a denial-of-service vulnerability where parsing application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs without max_num_fields allows unauthenticated requests with millions of fields to stall the event loop. This delays all connections due to synchronous parsing in the single-threaded event loop.

Detection Guidance

To detect this vulnerability, monitor for unusually large or malformed HTTP POST requests with excessive form fields. Check Tornado server logs for stalled connections or high CPU usage during request processing. No specific commands are provided in the context.

Impact Analysis

This vulnerability can cause service disruption by making the application unresponsive to all requests due to CPU exhaustion from parsing excessive form fields. It may lead to downtime or degraded performance for legitimate users.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt service availability. Under GDPR, availability is a key principle, and prolonged downtime may violate Article 32 requirements for security and resilience. HIPAA's Security Rule also mandates safeguards against disruptions that could compromise protected health information access.

Mitigation Strategies

Upgrade Tornado to version 6.5.8 or later to address the issue. If upgrading is not immediately possible, implement network-level protections to block or limit the size of POST requests with excessive fields.

Hi! I’m here to help you understand CVE-2026-82397. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70