Logo
›
›vulnerability›CVE-2026-31958
Name
CVE-2026-31958
Source
NVD ( link)Debian ( link)
Description
Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.
CWEs
CWE-400
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/tornadoweb/tornado/security/advisories/GHSA-qjxf-f2mg-c6mcVendor Advisory

Analysis#

Affected Component
Analysis
python-tornado
Exploitable

Vulnerability Ratings#

8.7
CVSSv4
7.5
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
python-tornado
buildroot
master
6.5.5
Not Affected
python-tornado
openwrt
master
6.5.5-r1
Not Affected
python-tornado
openwrt
openwrt-25.12
6.3.3-r1
Exploitable
python3-tornado
yocto
master
6.5.7
Not Affected
python3-tornado
yocto
scarthgap
6.4.2
Patched

Resolved with patches#

python3-tornado (yocto:scarthgap)

#
Title
Author
Resolve
1
httputil: Add limits on multipart form data parsing
Ben Darnell <ben@bendarnell.com>
CVE-2026-31958