CVE-2026-31958
published 2026-03-11CVE-2026-31958: Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.38%
30.2th percentile
Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-tornado | < python-tornado 6.1.0-1+deb11u4 (bullseye) | python-tornado 6.1.0-1+deb11u4 (bullseye) |
| tornadoweb | tornado | < 6.5.5 | 6.5.5 |
| tornadoweb | tornado | >= 0 < 6.5.5 | 6.5.5 |
| ubuntu | python-tornado | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv8.7HIGH
vendor_debian8.7HIGH
vendor_redhat8.7HIGH
vendor_ubuntu8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Tornado is vulnerable to DoS due to too many multipart parts
ghsa·2026-03-12
CVE-2026-31958 [HIGH] CWE-400 Tornado is vulnerable to DoS due to too many multipart parts
Tornado is vulnerable to DoS due to too many multipart parts
In versions of Tornado prior to 6.5.5, the only limit on the number of parts in `multipart/form-data` is the `max_body_size` setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts.
Tornado 6.5.5 introduces new limits on the size and complexity of multipart bodies, including a default limit of 100 parts per request. These limits are configurable if needed; see `tornado.httputil.ParseMultipartConfig`. It is also now possible to disable `multipart/form-data` parsing entirely if it is not required for the application.
OSV
Tornado is vulnerable to DoS due to too many multipart parts
osv·2026-03-12
CVE-2026-31958 [HIGH] Tornado is vulnerable to DoS due to too many multipart parts
Tornado is vulnerable to DoS due to too many multipart parts
In versions of Tornado prior to 6.5.5, the only limit on the number of parts in `multipart/form-data` is the `max_body_size` setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts.
Tornado 6.5.5 introduces new limits on the size and complexity of multipart bodies, including a default limit of 100 parts per request. These limits are configurable if needed; see `tornado.httputil.ParseMultipartConfig`. It is also now possible to disable `multipart/form-data` parsing entirely if it is not required for the application.
OSV
CVE-2026-31958: Tornado is a Python web framework and asynchronous networking library
osv·2026-03-11·CVSS 8.7
CVE-2026-31958 [HIGH] CVE-2026-31958: Tornado is a Python web framework and asynchronous networking library
Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.
Ubuntu
Tornado vulnerabilities
vendor_ubuntu·2026-04-28·CVSS 8.7
CVE-2026-35536 [HIGH] Tornado vulnerabilities
Title: Tornado vulnerabilities
Summary: Several security issues were fixed in Tornado.
USN-8198-1 fixed vulnerabilities in Tornado. This update provides the
corresponding updates for Ubuntu 26.04 LTS.
Original advisory details:
It was discovered that Tornado incorrectly handled parsing of large
multipart request bodies. An attacker could possibly use this issue to
cause a denial of service. (CVE-2026-31958)
It was discovered that Tornado did not properly validate characters in
cookie values. An attacker could possibly use this issue to inject
arbitrary cookie attributes. (CVE-2026-35536)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Tornado vulnerabilities
vendor_ubuntu·2026-04-22·CVSS 8.7
CVE-2026-31958 [HIGH] Tornado vulnerabilities
Title: Tornado vulnerabilities
Summary: Several security issues were fixed in Tornado.
It was discovered that Tornado incorrectly handled parsing of large
multipart request bodies. An attacker could possibly use this issue to
cause a denial of service. (CVE-2026-31958)
It was discovered that Tornado did not properly validate characters in
cookie values. An attacker could possibly use this issue to inject
arbitrary cookie attributes. (CVE-2026-35536)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
tornado-python: Tornado: Denial of Service via large multipart bodies
vendor_redhat·2026-03-11·CVSS 8.7
CVE-2026-31958 [HIGH] CWE-770 tornado-python: Tornado: Denial of Service via large multipart bodies
tornado-python: Tornado: Denial of Service via large multipart bodies
Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.
A flaw was found in tornado-python. A remote attacker can exploit this vulnerability by sending a specially crafted, very large multipart body with numerous parts. Because the parsing of these large bodies occurs synchronously on the main thread, it can consume excessive resources, leading to a
Debian
CVE-2026-31958: python-tornado - Tornado is a Python web framework and asynchronous networking library. In versio...
vendor_debian·2026·CVSS 8.7
CVE-2026-31958 [HIGH] CVE-2026-31958: python-tornado - Tornado is a Python web framework and asynchronous networking library. In versio...
Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.
Scope: local
bookworm: open
bullseye: resolved (fixed in 6.1.0-1+deb11u4)
forky: resolved (fixed in 6.5.5-1)
sid: resolved (fixed in 6.5.5-1)
trixie: open
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-31958 python-tornado: Tornado: Denial of Service via large multipart bodies [fedora-all]
bugzilla·2026-03-26·CVSS 7.5
CVE-2026-31958 [HIGH] CVE-2026-31958 python-tornado: Tornado: Denial of Service via large multipart bodies [fedora-all]
CVE-2026-31958 python-tornado: Tornado: Denial of Service via large multipart bodies [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-672e8e4169 (python-tornado-6.5.7-1.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-672e8e4169
---
FEDORA-2026-672e8e4169 (python-tornado-6.5.7-1.fc45) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.
---
FEDORA-2026-0f40de2581 (python-tornado-6.5.7-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.f
Bugzilla
CVE-2026-31958 python-pytest-tornado: Tornado: Denial of Service via large multipart bodies [epel-all]
bugzilla·2026-03-26·CVSS 7.5
CVE-2026-31958 [HIGH] CVE-2026-31958 python-pytest-tornado: Tornado: Denial of Service via large multipart bodies [epel-all]
CVE-2026-31958 python-pytest-tornado: Tornado: Denial of Service via large multipart bodies [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component.
Bugzilla
CVE-2026-31958 python-pytest-tornado: Tornado: Denial of Service via large multipart bodies [fedora-all]
bugzilla·2026-03-26·CVSS 7.5
CVE-2026-31958 [HIGH] CVE-2026-31958 python-pytest-tornado: Tornado: Denial of Service via large multipart bodies [fedora-all]
CVE-2026-31958 python-pytest-tornado: Tornado: Denial of Service via large multipart bodies [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component.
Bugzilla
CVE-2026-31958 tornado-python: Tornado: Denial of Service via large multipart bodies
bugzilla·2026-03-11·CVSS 8.7
CVE-2026-31958 [HIGH] CVE-2026-31958 tornado-python: Tornado: Denial of Service via large multipart bodies
CVE-2026-31958 tornado-python: Tornado: Denial of Service via large multipart bodies
Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2026:8093 https://access.redhat.com/errata/RHSA-2026:8093
Wiz
CVE-2026-31958 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.7
CVE-2026-31958 [HIGH] CVE-2026-31958 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-31958 :
Python vulnerability analysis and mitigation
Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.
Source : NVD
## 8.7
Score
Published March 11, 2026
Severity HIGH
CNA Score 8.7
Affected Technologies
Python
Wolfi
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 8.4
Exploitation Probability (EPS
2026-03-11
Published