--- id: CVE-2026-31958 title: Tornado is a Python web framework and asynchronous networking library summary: >- Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-400 - CWE-770 vendor: tornadoweb product: tornado affected: - tornado < 6.5.5 patched: - tornado 6.5.5 published: '2026-03-11' updated: '2026-06-17' sourceUpdated: '2026-06-17T10:34:50.473' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-31958' references: - url: >- https://github.com/tornadoweb/tornado/security/advisories/GHSA-qjxf-f2mg-c6mc label: security-advisories@github.com - url: 'https://lists.debian.org/debian-lts-announce/2026/04/msg00000.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31958.json - url: 'https://access.redhat.com/security/cve/CVE-2026-31958' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2446765' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-31958' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-31958' - url: 'https://access.redhat.com/errata/RHSA-2026:24342' - url: 'https://access.redhat.com/errata/RHSA-2026:20577' - url: 'https://access.redhat.com/errata/RHSA-2026:13641' - url: 'https://access.redhat.com/errata/RHSA-2026:19034' - url: 'https://access.redhat.com/errata/RHSA-2026:20573' - url: 'https://access.redhat.com/errata/RHSA-2026:20810' - url: 'https://access.redhat.com/errata/RHSA-2026:20572' - url: 'https://access.redhat.com/errata/RHSA-2026:13670' - url: 'https://access.redhat.com/errata/RHSA-2026:19189' - url: 'https://access.redhat.com/errata/RHSA-2026:8093' - url: 'https://access.redhat.com/errata/RHSA-2026:11493' - url: 'https://access.redhat.com/errata/RHSA-2026:11494' - url: 'https://access.redhat.com/errata/RHSA-2026:11495' - url: 'https://access.redhat.com/errata/RHSA-2026:11454' - url: 'https://access.redhat.com/errata/RHSA-2026:10184' - url: 'https://access.redhat.com/errata/RHSA-2026:24977' - url: 'https://access.redhat.com/errata/RHSA-2026:37275' tags: - nvd - cve.org - csaf - vex - red-hat - score-dispute ssvc: exploitation: none automatable: 'yes' technicalImpact: partial timestamp: '2026-03-12T19:55:43.911671Z' scores: nvd: 7.5 cna: 8.7 vendor: 5.3 ingestedAt: '2026-09-13T09:17:31.290Z' epss: 0.00488 epssPercentile: 0.39405 --- ## Overview Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5. ## Affected - `tornado < 6.5.5` ## Remediation Upgrade past the affected range: - `tornado 6.5.5` ## Vendor advisories - **RHSA-2026:24342** · Red Hat · fixed in: Red Hat Enterprise Linux Server Optional (v. 7 ELS) · released 2026-06-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:24342) - **RHSA-2026:20577** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20577) - **RHSA-2026:13641** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-05-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:13641) - **RHSA-2026:19034** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:19034) - **RHSA-2026:20573** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20573) - **RHSA-2026:20810** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.4) · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20810) - **RHSA-2026:20572** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20572) - **RHSA-2026:13670** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-05-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:13670) - **RHSA-2026:19189** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:19189) - **RHSA-2026:8093** · Red Hat · fixed in: Red Hat Enterprise Linux HighAvailability (v. 8), Red Hat Enterprise Linux ResilientStorage (v. 8) · released 2026-04-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:8093) - **RHSA-2026:11493** · Red Hat · fixed in: Red Hat Enterprise Linux High Availability AUS (v.8.4), Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) · released 2026-04-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:11493) - **Red Hat VEX** · Moderate · affected: Lightspeed Core, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat OpenShift AI (RHOAI), Lightspeed Core, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux AI (RHEL AI) 3 · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31958.json)