Tornado before 6.5.8 Memory Amplification DoS via multipart
Priority HIGH 77CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 8 fixed, 10 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-770.
Summary
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00424 36th percentileScored 2026-11-07
Fix Partial tornado (tornadoweb): 6.5.8Red Hat: 9 advisoriesRed Hat: 8 fixed, 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tornadoweb | tornado | before 6.5.8 | 6.5.8 | Patch available | CNA |
- tornado Vendortornadoweb Affected before 6.5.8 Fixed in 6.5.8 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:* | — | — | tornadoweb |
- cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:* Versions — — ·tornadoweb
Remediation
- Fix · CNA tornado (tornadoweb) Fixed in 6.5.8
Red Hat 9 advisories
- RHSA-2026:92510 Released 2026-10-29 · Red Hat rating CriticalRHOAI 3.4.6 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:90283 Released 2026-10-26 · Red Hat rating Importantpython-tornado security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) python-tornado-6.4.2-2.el9_6.7, python3-tornado-6.4.2-2.el9_6.7
- RHSA-2026:87410 Released 2026-10-21 · Red Hat rating CriticalRHOAI 2.25.12 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
Show 6 more Red Hat advisories
- RHSA-2026:86891 Released 2026-10-21 · Red Hat rating CriticalRHOAI 3.5.2 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
- RHSA-2026:80741 Released 2026-10-12 · Red Hat rating Importantpython-tornado security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) python-tornado-6.5.8-0.el10_0.1, python3-tornado-6.5.8-0.el10_0.1
- RHSA-2026:79378 Released 2026-10-08 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.7 Container Release Update
- Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-supported-rhel9, registry.redhat.io/ansible-automation-platform-27/gateway-rhel9 +4
- RHSA-2026:67146 Released 2026-09-14 · Red Hat rating Importantpython-tornado security update
- Red Hat Enterprise Linux AppStream (v. 9) python-tornado-6.5.8-0.el9_8.1, python3-tornado-6.5.8-0.el9_8.1
- RHSA-2026:67147 Released 2026-09-14 · Red Hat rating Importantpython-tornado security update
- Red Hat Enterprise Linux AppStream (v. 10) python-tornado-6.5.8-0.el10_2.1, python3-tornado-6.5.8-0.el10_2.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
tornadoweb tornado 6.5.8
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2026-62121 Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargsPriority MEDIUM 61
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix planned: Will not fix |
| Lightspeed Core | Affected | No fix yet |
| OpenShift Lightspeed | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2.7 | Fixed | RHSA-2026:79378 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:67147 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:67146 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:80741 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:90283 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:87410 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:84734, RHSA-2026:92510 |
| Red Hat OpenShift AI 3.5 | Fixed | RHSA-2026:86891 |
Not affected: 10 products
- Migration Toolkit for Applications 8
- Red Hat Ansible Automation Platform 2.7
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift AI 3.5
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-91990
- 2026-10-03 Alias added: GHSA-wwvv-qf38-wpf3
- 2026-10-09 Fix available: RHSA-2026:79378 · Red Hat
- 2026-10-09 Fix available: Red Hat Ansible Automation Platform 2.7 · Red Hat
- 2026-10-10 Fix available: RHSA-2026:67146 · Red Hat
- 2026-10-10 Fix available: RHSA-2026:67147 · Red Hat
- 2026-10-10 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 9) · Red Hat
- 2026-10-12 Fix available: RHSA-2026:80741 · Red Hat
- 2026-10-12 Fix available: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · Red Hat
- 2026-10-13 Affected versions changed · Red Hat
- 2026-10-18 Affected versions changed · Red Hat
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
- 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
- 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
- 2026-10-23 Fix available: Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.5 · Red Hat
- 2026-10-27 Fix available: Red Hat Enterprise Linux AppStream EUS (v.9.6) · Red Hat
- 2026-10-29 Fix available: RHSA-2026:90283 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
References
More tornadoweb vulnerabilities
- TI-2026-65637 Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient CVSS 4.0HIGH 8.7
- TI-2024-13023 Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding CVSS 4.0CRITICAL 9.0
- TI-2026-65638 Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink CVSS 4.0HIGH 8.2
- TI-2026-62122 Tornado before 6.5.7 Credential Leak via Handle Reuse CVSS 4.0HIGH 8.2
- TI-2026-62121 Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs CVSS 4.0MEDIUM 6.3
- TI-2026-86676 Path traversal in Tornado static_url() version hashing CVSS 4.0HIGH 8.3
Sources
- CVE-2026-91990 · CVE Program
- CVE-2026-91990 · NVD
- FIRST EPSS
- GHSA-wwvv-qf38-wpf3 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-91990 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences