CVE-2026-82397: Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest.parsebody and parsebodyarguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by maxbuffersize, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
tornadoto a version that resolves this vulnerability.Fixed in 6.5.8
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Tornado deployments running versions prior to 6.5.8 are affected when they accept application/x-www-form-urlencoded request bodies. The issue occurs before handler dispatch, so endpoints do not need to explicitly parse form data for the event loop to be stalled.
What does an attacker need to exploit it?
An attacker needs only network access to send an unauthenticated HTTP request with a URL-encoded body containing millions of separator-delimited fields. No privileges or user interaction are required.
Are default settings sufficient to limit the impact?
No. The request body is limited by max_buffer_size, but its default is 104857600 bytes, which can still accommodate enough fields to synchronously stall the single-threaded event loop and delay all connections.
How can this be remediated?
Upgrade Tornado to version 6.5.8, which fixes the missing max_num_fields limit during URL-encoded body parsing.