Bug 2533953 (CVE-2026-91990) - CVE-2026-91990 tornado: Tornado: Denial of Service via memory amplification in multipart parsing
Summary: CVE-2026-91990 tornado: Tornado: Denial of Service via memory amplification i...
Keywords:
Status: NEW
Alias: CVE-2026-91990
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-15 15:52 UTC by OSIDB Bzimport
Modified: 2026-09-16 03:08 UTC (History)
49 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-15 15:52:12 UTC 
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.
Note You need to log in before you can comment on or make changes to this bug.