CVE-2026-82397

Tornado ≤6.5.7 allows massive form fields to block the event loop, causing DoS.

• CVSS 7.5
• 400
• Resource Management
• Remote

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.

CVE

CVE-2026-82397

CWE

400

CVSS base score

7.5

Published

2026-08-31

OWASP

A04 Insecure Design

Orthogonal defect classification

Timing/Serialization

Code defect classification

Timing Issues

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

Tornado

Fixed by upgrading

Yes

Solution

Upgrade Tornado to version 6.5.8 or newer.

import urllib.parse
from tornado.web import RequestHandler

class EchoHandler(RequestHandler):
    def post(self):
        # VULNERABLE: unbounded parse_qs allows resource exhaustion
        args = urllib.parse.parse_qs(self.request.body.decode())
        self.write({"received": len(args)})

import urllib.parse
from tornado.web import RequestHandler

class EchoHandler(RequestHandler):
    def post(self):
        # FIX: limit number of fields parsed to prevent exhaustion
        args = urllib.parse.parse_qs(self.request.body.decode(), max_num_fields=1000)
        self.write({"received": len(args)})

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202682397,
  title        = {{Tornado ≤6.5.7 allows massive form fields to block the event loop, causing DoS.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-82397},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-82397/}}
}