CVE-2026-91990 — Tornado before 6.5.8 Memory Amplification DoS via multipart
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can s…
Published: 2026-09-15 · CVSS: 8.7 · CVSS 4.0
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7