Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-qjxf-f2mg-c6mc

Опубликовано: 12 мар. 2026
Источник: github
Github: Прошло ревью
CVSS4: 8.7

Описание

Tornado is vulnerable to DoS due to too many multipart parts

In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts.

Tornado 6.5.5 introduces new limits on the size and complexity of multipart bodies, including a default limit of 100 parts per request. These limits are configurable if needed; see tornado.httputil.ParseMultipartConfig. It is also now possible to disable multipart/form-data parsing entirely if it is not required for the application.

Пакеты

Наименование

tornado

pip
Затронутые версииВерсия исправления

<= 6.5.4

6.5.5

EPSS

Процентиль: 6%
0.00023
Низкий

8.7 High

CVSS4

Дефекты

CWE-400

Связанные уязвимости

CVSS3: 7.5
ubuntu
16 дней назад

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.

CVSS3: 5.3
redhat
16 дней назад

A flaw was found in tornado-python. A remote attacker can exploit this vulnerability by sending a specially crafted, very large multipart body with numerous parts. Because the parsing of these large bodies occurs synchronously on the main thread, it can consume excessive resources, leading to a denial of service (DoS) for the application.

CVSS3: 7.5
nvd
16 дней назад

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.

CVSS3: 7.5
debian
16 дней назад

Tornado is a Python web framework and asynchronous networking library. ...

EPSS

Процентиль: 6%
0.00023
Низкий

8.7 High

CVSS4

Дефекты

CWE-400