CVE-2026-103261: Tornado before 6.5.9 Denial of Service via Query String
Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.init, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts to degrade response times for all clients sharing the same IOLoop.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Tornado versions before 6.5.9 that accept HTTP requests are exposed. The impact is greatest when multiple clients share an IOLoop, because stalled event-loop processing can degrade response times for all of them.
Does exploitation require authentication or user interaction?
No. An attacker can send unauthenticated GET requests containing thousands of query parameters; no user interaction is required.
What is the practical impact of a successful attack?
The attacker can cause event-loop stalling and degrade application response times, resulting in a denial-of-service condition. The provided severity vector indicates availability impact only, with no stated confidentiality or integrity impact.