Bug 2544529 (CVE-2026-103261) - CVE-2026-103261 tornado: tornado: Denial of Service (DoS) via unbounded query string parsing
Summary: CVE-2026-103261 tornado: tornado: Denial of Service (DoS) via unbounded query...
Keywords:
Status: NEW
Alias: CVE-2026-103261
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-01 10:56 UTC by OSIDB Bzimport
Modified: 2026-10-01 12:53 UTC (History)
50 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-01 10:56:12 UTC 
Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts to degrade response times for all clients sharing the same IOLoop.
Note You need to log in before you can comment on or make changes to this bug.