CVE-2026-91990
published 2026-09-15CVE-2026-91990: Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.42%
35.6th percentile
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.
Affected
65 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| clusterlabs | pcs | — | — |
| debian | python-tornado | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| lightspeed-core | rag-tool-cpu-rhel9 | — | — |
| lightspeed-core | rag-tool-cuda-12.9-rhel9 | — | — |
| mta | mta-solution-server-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| rhel10 | keylime-registrar | — | — |
| rhel10 | keylime-verifier | — | — |
| rhel9 | keylime-registrar | — | — |
| rhel9 | keylime-verifier | — | — |
| rhelai3 | bootc-cuda-rhel9 | — | — |
| rhelai3 | bootc-gaudi-rhel9 | — | — |
| rhelai3 | bootc-rocm-rhel9 | — | — |
| rhelai3 | disk-image-cuda-rhel9 | — | — |
| rhoai | odh-feature-server-rhel9 | — | — |
| rhoai | odh-llama-stack-core-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
tornado: Tornado: Denial of Service via memory amplification in multipart parsing
vendor_redhat·2026-09-15·CVSS 7.5
CVE-2026-91990 [HIGH] CWE-770 tornado: Tornado: Denial of Service via memory amplification in multipart parsing
tornado: Tornado: Denial of Service via memory amplification in multipart parsing
A flaw was found in Tornado. This memory amplification vulnerability exists in the `parse_multipart_form_data` function, where multipart data is processed before validating the maximum number of parts. A remote attacker can exploit this by sending specially crafted multipart requests with numerous parts. This can lead to the creation of large temporary data structures, exhausting server memory and resulting in a Denial of Service (DoS) for the affected system.
Package: exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 (Exploit Intelligence) - Affected
Package: lightspeed-core/lightspeed-stack-rhel9 (Lightspeed Core) - Affected
Package: lightspeed-core/rag-tool-cpu-rhel9 (Lightspeed Core) - Af
GHSA
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit.
ghsa_unreviewed·2026-09-15
CVE-2026-91990 [HIGH] CWE-770 Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit.
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-91990 python-flit: Tornado: Denial of Service via memory amplification in multipart parsing [epel-all]
bugzilla·2026-09-24·CVSS 7.5
CVE-2026-91990 [HIGH] CVE-2026-91990 python-flit: Tornado: Denial of Service via memory amplification in multipart parsing [epel-all]
CVE-2026-91990 python-flit: Tornado: Denial of Service via memory amplification in multipart parsing [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.
Discussion:
Reassigning from `epel10` to `epel9`: Bug filed against a branch the package never shipped on.
Bugzilla
CVE-2026-91990 python-flit: Tornado: Denial of Service via memory amplification in multipart parsing [fedora-all]
bugzilla·2026-09-24·CVSS 7.5
CVE-2026-91990 [HIGH] CVE-2026-91990 python-flit: Tornado: Denial of Service via memory amplification in multipart parsing [fedora-all]
CVE-2026-91990 python-flit: Tornado: Denial of Service via memory amplification in multipart parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.
Bugzilla
CVE-2026-91990 python-pep517: Tornado: Denial of Service via memory amplification in multipart parsing [epel-all]
bugzilla·2026-09-24·CVSS 7.5
CVE-2026-91990 [HIGH] CVE-2026-91990 python-pep517: Tornado: Denial of Service via memory amplification in multipart parsing [epel-all]
CVE-2026-91990 python-pep517: Tornado: Denial of Service via memory amplification in multipart parsing [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.
Bugzilla
CVE-2026-91990 tornado: Tornado: Denial of Service via memory amplification in multipart parsing
bugzilla·2026-09-15·CVSS 7.5
CVE-2026-91990 [HIGH] CVE-2026-91990 tornado: Tornado: Denial of Service via memory amplification in multipart parsing
CVE-2026-91990 tornado: Tornado: Denial of Service via memory amplification in multipart parsing
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.
2026-09-15
Published