CVE-2026-91990

EUVD-2026-78661
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
tornadowebtornado
𝑥
< 6.5.8
CNA
Debian logo
Debian Releases
Debian Product
Codename
python-tornado
bookworm
vulnerable
bookworm (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
trixie (security)
vulnerable
Common Weakness Enumeration
References
https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq
https://www.vulncheck.com/advisories/tornado-before-6.5.8-memory-amplification-dos-via-multipart
https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq