CVE-2026-31958

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/tornadoweb/tornado/security/advisories/GHSA-qjxf-f2mg-c6mc	Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/04/msg00000.html

Configurations

Configuration 1 (hide)

cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:*

History

01 Apr 2026, 15:23

Type	Values Removed	Values Added
References		() https://lists.debian.org/debian-lts-announce/2026/04/msg00000.html -

16 Mar 2026, 19:32

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
CPE		cpe:2.3:a:tornadoweb:tornado::::::::
Summary		(es) Tornado es un framework web de Python y una biblioteca de red asíncrona. En versiones de Tornado anteriores a la 6.5.5, el único límite en el número de partes en multipart/form-data es la configuración max_body_size (predeterminado 100MB). Dado que el análisis ocurre de forma síncrona en el hilo principal, esto crea la posibilidad de denegación de servicio debido al costo de analizar cuerpos multipart muy grandes con muchas partes. Esta vulnerabilidad se corrige en la 6.5.5.
References	~~() https://github.com/tornadoweb/tornado/security/advisories/GHSA-qjxf-f2mg-c6mc -~~	() https://github.com/tornadoweb/tornado/security/advisories/GHSA-qjxf-f2mg-c6mc - Vendor Advisory
First Time		Tornadoweb Tornadoweb tornado

11 Mar 2026, 20:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-11 20:16

Updated : 2026-04-01 15:23

NVD link : CVE-2026-31958

Mitre link : CVE-2026-31958

CVE.ORG link : CVE-2026-31958

JSON object : View

Products Affected

tornadoweb

tornado

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-31958", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-03-11T20:16:16.617", "references": [{"url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-qjxf-f2mg-c6mc", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://lists.debian.org/debian-lts-announce/2026/04/msg00000.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5."}, {"lang": "es", "value": "Tornado es un framework web de Python y una biblioteca de red as\u00edncrona. En versiones de Tornado anteriores a la 6.5.5, el \u00fanico l\u00edmite en el n\u00famero de partes en multipart/form-data es la configuraci\u00f3n max_body_size (predeterminado 100MB). Dado que el an\u00e1lisis ocurre de forma s\u00edncrona en el hilo principal, esto crea la posibilidad de denegaci\u00f3n de servicio debido al costo de analizar cuerpos multipart muy grandes con muchas partes. Esta vulnerabilidad se corrige en la 6.5.5."}], "lastModified": "2026-04-01T15:23:00.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00D7B62E-5B93-4654-80D9-C7B7BC3A5BB8", "versionEndExcluding": "6.5.5"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}