CVE-2026-91990: Tornado before 6.5.8 Memory Amplification DoS via multipart
Tornado before 6.5.8 contains a memory amplification vulnerability in parsemultipartformdata that splits multipart data before validating the maxparts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it by sending crafted multipart requests with many parts to a Tornado application that processes multipart form data.
Are default deployments affected?
The issue affects Tornado versions before 6.5.8 when multipart form data is parsed. The provided information does not identify any configuration prerequisite or workaround.
What is the operational impact of exploitation?
Crafted requests can force creation of large transient lists before the max_parts limit is validated, exhausting server memory and causing denial of service.