GHSA-8423-8fgw-73vqMedium▾ Sunlittornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
parse_multipart_form_data (httputil.py:34) calls
data.split(b"--"+boundary+b"\r\n") before the max_parts check (:35).
A 600KB body with 100k parts creates a 100k-element transient list first,
then rejects transient memory amplification (each split element is a copy).
Pre-auth HTTP DoS.
parts = data[:final_boundary_index].split(b"--" + boundary + b"\r\n") # :34 huge list first
if len(parts) > config.max_parts: # :35 check after
raise HTTPInputError("multipart/form-data has too many parts")
gist: https://gist.github.com/afldl/649861f25d39b53b7edbe0298e171617
poc.py + output.txt (100k parts from 600KB transient list).
Count separators without materializing the list (e.g. data.count(b"--"+boundary) first).
Reported by afldl, 2026-07.
tornado < 6.5.8Upgrade to a patched release:
tornado 6.5.8Connected by shared product, vendor, weakness, or advisory.
CVE-2026-91990High· 7.5Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit
CVE-2026-91991Medium· 5.4Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie
CVE-2026-82397High· 7.5Tornado is a Python web framework and asynchronous networking library
GHSA-wwv5-g3v4-889xLowTornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_…
CVE-2024-58384Medium· 5.4Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers
CVE-2023-54397High· 7.5Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters