Tornado has a DoS due to too many multipart parts
Priority MEDIUM 44CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 19 fixed, 4 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00417 36th percentileScored 2026-11-07
Fix Partial tornado (tornadoweb): 6.5.5tornado (PyPI): 6.5.5Red Hat: 18 advisoriesRed Hat: 19 fixed, 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tornadoweb | tornado | before 6.5.5 | 6.5.5 | Patch available | CNA |
| — | tornado (PyPI) | before 6.5.5 | 6.5.5 | Patch available | GHSA-qjxf-f2mg-c6mc |
- tornado Vendortornadoweb Affected before 6.5.5 Fixed in 6.5.5 Patch available CNA
- tornado (PyPI) Vendor— Affected before 6.5.5 Fixed in 6.5.5 Patch available GHSA-qjxf-f2mg-c6mc
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:* | before 6.5.5 | Vulnerable | tornadoweb |
- cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:* Versions before 6.5.5 Vulnerable ·tornadoweb
Remediation
- Fix · CNA tornado (tornadoweb) Fixed in 6.5.5
- Fix · GHSA-qjxf-f2mg-c6mc tornado (PyPI) Fixed in 6.5.5 Advisory →
Red Hat 18 advisories
- RHSA-2026:73987 Released 2026-09-30 · Red Hat rating CriticalRHOAI 3.3.7 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
- RHSA-2026:37275 Released 2026-07-09 · Red Hat rating CriticalRHOAI 3.3.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9, registry.redhat.io/rhoai/odh-feast-operator-rhel9 +45
- RHSA-2026:24977 Released 2026-06-10 · Red Hat rating ImportantRHOAI 2.25.7 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +34
Show 15 more Red Hat advisories
- RHSA-2026:24342 Released 2026-06-08 · Red Hat rating Moderatepython-tornado security update
- Red Hat Enterprise Linux Server Optional (v. 7 ELS) python-tornado-4.2.1-5.el7_9.3, python-tornado-doc-4.2.1-5.el7_9.3
- RHSA-2026:20810 Released 2026-05-26 · Red Hat rating Moderatepython-tornado security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) python-tornado-6.4.2-1.el9_4.2, python3-tornado-6.4.2-1.el9_4.2
- RHSA-2026:20572 Released 2026-05-26 · Red Hat rating Moderatepython-tornado security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) python-tornado-6.4.2-2.el9_6.3, python3-tornado-6.4.2-2.el9_6.3
- RHSA-2026:20577 Released 2026-05-26 · Red Hat rating Moderatepython-tornado security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) python-tornado-6.4.2-1.el10_0.2, python3-tornado-6.4.2-1.el10_0.2
- RHSA-2026:20573 Released 2026-05-26 · Red Hat rating Moderatepython-tornado security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) python-tornado-6.4.2-1.el9_2.2, python3-tornado-6.4.2-1.el9_2.2
- RHSA-2026:19189 Released 2026-05-19 · Red Hat rating Moderatepython-tornado security update
- Red Hat Enterprise Linux AppStream (v. 9) python-tornado-6.5.5-1.el9_8, python3-tornado-6.5.5-1.el9_8
- RHSA-2026:19034 Released 2026-05-19 · Red Hat rating Moderatepython-tornado security update
- Red Hat Enterprise Linux AppStream (v. 10) python-tornado-6.5.5-1.el10_2, python3-tornado-6.5.5-1.el10_2
- RHSA-2026:13670 Released 2026-05-05 · Red Hat rating Moderatepython-tornado security update
- Red Hat Enterprise Linux AppStream (v. 9) python-tornado-6.5.5-1.el9_7.1, python3-tornado-6.5.5-1.el9_7.1
- RHSA-2026:13641 Released 2026-05-05 · Red Hat rating Moderatepython-tornado security update
- Red Hat Enterprise Linux AppStream (v. 10) python-tornado-6.5.5-1.el10_1.1, python3-tornado-6.5.5-1.el10_1.1
- RHSA-2026:11493 Released 2026-04-29 · Red Hat rating Importantpcs security update
- Red Hat Enterprise Linux High Availability AUS (v.8.4) pcs-0.10.8-1.el8_4.11, pcs-snmp-0.10.8-1.el8_4.11
- Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) pcs-0.10.8-1.el8_4.11, pcs-snmp-0.10.8-1.el8_4.11
- RHSA-2026:11495 Released 2026-04-29 · Red Hat rating Importantpcs security update
- Red Hat Enterprise Linux High Availability E4S (v.8.8) pcs-0.10.15-4.el8_8.11, pcs-snmp-0.10.15-4.el8_8.11
- Red Hat Enterprise Linux High Availability TUS (v.8.8) pcs-0.10.15-4.el8_8.11, pcs-snmp-0.10.15-4.el8_8.11
- RHSA-2026:11494 Released 2026-04-29 · Red Hat rating Importantpcs security update
- Red Hat Enterprise Linux High Availability E4S (v.8.6) pcs-0.10.12-6.el8_6.13, pcs-snmp-0.10.12-6.el8_6.13
- Red Hat Enterprise Linux High Availability TUS (v.8.6) pcs-0.10.12-6.el8_6.13, pcs-snmp-0.10.12-6.el8_6.13
- RHSA-2026:11454 Released 2026-04-29 · Red Hat rating Importantpcs security update
- Red Hat Enterprise Linux High Availability E4S (v.9.0) pcs-0.11.1-10.el9_0.11, pcs-snmp-0.11.1-10.el9_0.11
- Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) pcs-0.11.1-10.el9_0.11, pcs-snmp-0.11.1-10.el9_0.11
- RHSA-2026:10184 Released 2026-04-23 · Red Hat rating ImportantRHOAI 2.25.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:8093 Released 2026-04-14 · Red Hat rating Moderatepcs security update
- Red Hat Enterprise Linux HighAvailability (v. 8) pcs-0.10.18-2.el8_10.9, pcs-snmp-0.10.18-2.el8_10.9
- Red Hat Enterprise Linux ResilientStorage (v. 8) pcs-0.10.18-2.el8_10.9, pcs-snmp-0.10.18-2.el8_10.9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Lightspeed Core | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:13641, RHSA-2026:19034 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:13670, RHSA-2026:19189 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2026:20573 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:20577 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2026:20810 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:20572 |
| Red Hat Enterprise Linux High Availability AUS (v.8.4) | Fixed | RHSA-2026:11493 |
| Red Hat Enterprise Linux High Availability E4S (v.8.6) | Fixed | RHSA-2026:11494 |
| Red Hat Enterprise Linux High Availability E4S (v.8.8) | Fixed | RHSA-2026:11495 |
| Red Hat Enterprise Linux High Availability E4S (v.9.0) | Fixed | RHSA-2026:11454 |
| Red Hat Enterprise Linux High Availability TUS (v.8.6) | Fixed | RHSA-2026:11494 |
| Red Hat Enterprise Linux High Availability TUS (v.8.8) | Fixed | RHSA-2026:11495 |
| Red Hat Enterprise Linux HighAvailability (v. 8) | Fixed | RHSA-2026:8093 |
| Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) | Fixed | RHSA-2026:11493 |
| Red Hat Enterprise Linux ResilientStorage (v. 8) | Fixed | RHSA-2026:8093 |
| Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) | Fixed | RHSA-2026:11454 |
| Red Hat Enterprise Linux Server Optional (v. 7 ELS) | Fixed | RHSA-2026:24342 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:10184, RHSA-2026:24977 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:37275, RHSA-2026:73987 |
Not affected: 6 products
- External Secrets Operator for Red Hat OpenShift
- OpenShift Lightspeed
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-31958
- 2026-10-03 Alias added: GHSA-qjxf-f2mg-c6mc
- 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
References
Advisory 2
Other 5
- https://github.com/tornadoweb/tornado/commit/119a195e290c43ad2d63a2cf012c29d43d6ed839
- https://github.com/pypa/advisory-database/tree/main/vulns/tornado/PYSEC-2026-140.yaml
- https://github.com/tornadoweb/tornado
- https://github.com/tornadoweb/tornado/releases/tag/v6.5.5
- https://lists.debian.org/debian-lts-announce/2026/04/msg00000.html
More tornadoweb Tornado vulnerabilities
- TI-2024-35317 Tornado has HTTP cookie parsing DoS vulnerability CVSS 3.1HIGH 7.5
- TI-2025-41422 Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters CVSS 3.1HIGH 7.5
- TI-2025-41421 Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing CVSS 3.1HIGH 7.5
- TI-2025-29817 Tornado vulnerable to excessive logging caused by malformed multipart form data CVSS 3.1HIGH 7.5
- TI-2026-27646 In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path… CVSS 3.1HIGH 7.2
- TI-2014-07904 Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be… CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-31958 · CVE Program
- CVE-2026-31958 · NVD
- FIRST EPSS
- GHSA-qjxf-f2mg-c6mc · GitHub Advisory Database · CC BY 4.0
- CVE-2026-31958 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences