Bug 2526562 (CVE-2026-82397)

Summary:	CVE-2026-82397 python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, anpicker, aos-team-art-private, asdas, bbrownin, bparees, dpaolell, dschmidt, ebourniv, eglynn, hasun, ikhan, jdelft, jfula, jjoyce, jlanda, jowilson, jpretori, jschluet, jupierce, jwong, kaycoth, kshier, lgarciaa, lhh, mbiarnes, mburns, mgarciac, nyancey, omaciel, ometelka, ppalepu, ppostler, prdhamdh, ptisnovs, rbobbitt, rhel-process-autobot, rjohnson, sbunciak, sghai, sidsharm, simaishi, stcannon, suppawar, syedriko, ttakamiy, vlaad, watson-tool-maintainers, xdharmai, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Tornado. An unauthenticated remote attacker could send a specially crafted request with a large number of fields in the URL-encoded body. This could cause the single-threaded event loop to stall, leading to a Denial of Service (DoS) for all connections. The vulnerability occurs because the urllib.parse.parse_qs function is used without limiting the maximum number of fields.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2542503, 2542504
Bug Blocks:

Description OSIDB Bzimport 2026-08-31 21:41:14 UTC

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.