---
id: CVE-2026-82397
title: Tornado is a Python web framework and asynchronous networking library
summary: >-
  Tornado is a Python web framework and asynchronous networking library. Prior
  to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with
  urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields.
  Reques…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
  - CWE-1284
vendor: tornado
product: tornado
affected:
  - tornado <= 6.5.7
patched:
  - tornado 6.5.8
published: '2026-08-31'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82397'
references:
  - url: >-
      https://github.com/tornadoweb/tornado/commit/8d6363ed7b69d5f0da806efe34d256627a2191de
    label: security-advisories@github.com
  - url: 'https://github.com/tornadoweb/tornado/pull/3704'
    label: security-advisories@github.com
  - url: 'https://github.com/tornadoweb/tornado/releases/tag/v6.5.8'
    label: security-advisories@github.com
  - url: >-
      https://github.com/tornadoweb/tornado/security/advisories/GHSA-mpf4-983q-p7j4
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82397'
  - url: 'https://github.com/advisories/GHSA-mpf4-983q-p7j4'
  - url: 'https://github.com/tornadoweb/tornado'
  - url: 'https://pypi.org/project/tornado'
tags:
  - nvd
  - ghsa
  - pip
  - osv
epss: 0.0035
epssPercentile: 0.28635
aliases:
  - GHSA-mpf4-983q-p7j4
  - PYSEC-2026-3928
ecosystem: pip
ingestedAt: '2026-09-02T14:45:29.925Z'
---

## Overview

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-82397)

Affected packages:

- `tornado <= 6.5.7`

Patched in:

- `tornado 6.5.8`

Source: https://github.com/advisories/GHSA-mpf4-983q-p7j4