Vulnerability Description
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq
- https://www.vulncheck.com/advisories/tornado-before-6.5.8-memory-amplification-d
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq
FAQ
What is CVE-2026-91990?
CVE-2026-91990 is a vulnerability with a CVSS score of 7.5 (HIGH). Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart r...
How severe is CVE-2026-91990?
CVE-2026-91990 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-91990?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.