CVE-2026-82397
published 2026-08-31CVE-2026-82397: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.35%
26.9th percentile
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.
Affected
65 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| clusterlabs | pcs | — | — |
| debian | python-tornado | — | — |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| lightspeed-core | rag-tool-cpu-rhel9 | — | — |
| lightspeed-core | rag-tool-cuda-12.9-rhel9 | — | — |
| mta | mta-solution-server-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| rhel10 | keylime-registrar | — | — |
| rhel10 | keylime-verifier | — | — |
| rhel9 | keylime-registrar | — | — |
| rhel9 | keylime-verifier | — | — |
| rhelai3 | bootc-cuda-rhel9 | — | — |
| rhelai3 | bootc-gaudi-rhel9 | — | — |
| rhelai3 | bootc-rocm-rhel9 | — | — |
| rhelai3 | disk-image-cuda-rhel9 | — | — |
| rhoai | odh-feature-server-rhel9 | — | — |
| rhoai | odh-llama-stack-core-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-rocm-py312-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
ghsa·2026-09-02
CVE-2026-82397 [HIGH] CWE-1284 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
## Summary
Tornado parses `application/x-www-form-urlencoded` bodies with `urllib.parse.parse_qs` and does not pass `max_num_fields`. A body made almost entirely of separators produces tens of millions of fields, and the parse happens on the event loop before the handler runs, so a single request stalls the whole server.
## Where it is
`tornado/escape.py`, at HEAD `e530031405e2154654dedc4c84d5656b557ea310`:
```python
result = urllib.parse.parse_qs(
qs, keep_blank_values, strict_parsing, encoding="latin1", errors="strict"
)
```
`max_num_fields` is the parameter CPython added for exactly this, and it is absent.
The path to it is entirely server-side and pre-dispatch. `RequestHandler._execute
VulDB
tornadoweb Tornado up to 6.5.7 Request Body Parsing tornado/web.py RequestHandler._execute infinite loop
vuldb·2026-08-31·CVSS 7.5
CVE-2026-82397 [HIGH] tornadoweb Tornado up to 6.5.7 Request Body Parsing tornado/web.py RequestHandler._execute infinite loop
A vulnerability categorized as problematic has been discovered in tornadoweb Tornado up to 6.5.7. Affected by this vulnerability is the function RequestHandler._execute of the file tornado/web.py of the component Request Body Parsing. Such manipulation leads to infinite loop.
This vulnerability is documented as CVE-2026-82397. The attack can be executed remotely. There is not any exploit available.
It is advisable to upgrade the affected component.
Red Hat
python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields
vendor_redhat·2026-08-31·CVSS 7.5
CVE-2026-82397 [HIGH] CWE-1050 python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields
python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.
A flaw was found in Tornado. An
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-82397 python-flit: Tornado: Denial of Service via excessive URL-encoded body fields [epel-all]
bugzilla·2026-10-08·CVSS 7.5
CVE-2026-82397 [HIGH] CVE-2026-82397 python-flit: Tornado: Denial of Service via excessive URL-encoded body fields [epel-all]
CVE-2026-82397 python-flit: Tornado: Denial of Service via excessive URL-encoded body fields [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-de
Bugzilla
CVE-2026-82397 python-pep517: Tornado: Denial of Service via excessive URL-encoded body fields [epel-all]
bugzilla·2026-10-08·CVSS 7.5
CVE-2026-82397 [HIGH] CVE-2026-82397 python-pep517: Tornado: Denial of Service via excessive URL-encoded body fields [epel-all]
CVE-2026-82397 python-pep517: Tornado: Denial of Service via excessive URL-encoded body fields [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-
Bugzilla
CVE-2026-82397 python-flit: Tornado: Denial of Service via excessive URL-encoded body fields [fedora-all]
bugzilla·2026-10-08·CVSS 7.5
CVE-2026-82397 [HIGH] CVE-2026-82397 python-flit: Tornado: Denial of Service via excessive URL-encoded body fields [fedora-all]
CVE-2026-82397 python-flit: Tornado: Denial of Service via excessive URL-encoded body fields [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-
Bugzilla
CVE-2026-82397 python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields [epel-all]
bugzilla·2026-09-28·CVSS 7.5
CVE-2026-82397 [HIGH] CVE-2026-82397 python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields [epel-all]
CVE-2026-82397 python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator
Bugzilla
CVE-2026-82397 python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields [fedora-all]
bugzilla·2026-09-28·CVSS 7.5
CVE-2026-82397 [HIGH] CVE-2026-82397 python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields [fedora-all]
CVE-2026-82397 python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separat
Bugzilla
CVE-2026-82397 python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields
bugzilla·2026-08-31·CVSS 7.5
CVE-2026-82397 [HIGH] CVE-2026-82397 python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields
CVE-2026-82397 python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.
2026-08-31
Published