Description

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-31T22:17:22.920Z",
  "pubdate": "2026-08-31T22:17:22.920Z",
  "executiveSummary": "A Denial of Service (DoS) vulnerability exists in the Tornado web framework prior to version 6.5.8, stemming from improper input parsing of application/x-www-form-urlencoded request bodies.\nThe vulnerability allows an unauthenticated remote attacker to trigger a synchronous, resource-intensive operation by sending a specially crafted request containing a vast number of fields.\nBecause Tornado utilizes a single-threaded asynchronous event loop, the excessive processing time required to parse these fields causes the entire event loop to stall.\nThis blockage prevents the server from processing other concurrent connections, resulting in a complete temporary service interruption for all users.\nThe attack is trivial to execute as it does not require authentication or specific privileges, relying solely on the default server configuration which bounds the total body size rather than the number of fields processed by the parser.\nThis represents a significant availability risk for services relying on Tornado to handle high-traffic web requests.",
  "technicalDetails": "The vulnerability resides in the interaction between tornado/escape.py and tornado/httputil.py during the parsing of HTTP request bodies.\nIn affected versions (prior to 6.5.8), Tornado utilizes urllib.parse.parse_qs within the tornado/escape.py module to process application/x-www-form-urlencoded data.\nThe root cause is the failure to define a max_num_fields parameter when calling parse_qs, which leaves the function susceptible to CPU exhaustion when processing requests with an extremely large volume of key-value pairs.\nThe attack flow begins when an attacker sends an HTTP request with a crafted body containing millions of separator-delimited fields.\nThis request is intercepted by the HTTPServerRequest._parse_body and parse_body_arguments methods in tornado/httputil.py during the RequestHandler._execute lifecycle, prior to actual handler dispatch.\nBecause Tornado’s architecture is fundamentally built on a single-threaded event loop, the synchronous execution of parse_qs becomes a blocking operation.\nThe underlying issue is exacerbated by the fact that the input is only restricted by max_buffer_size, which defaults to 104857600 bytes (100MB). An attacker can easily construct a malicious payload within this size limit that forces parse_qs to expend massive amounts of CPU cycles iterating through and allocating objects for the millions of fields provided.\nSince the event loop is blocked while performing this synchronous parsing, the application is unable to handle concurrent I/O events, heartbeat signals, or new connection requests, effectively halting the server's availability until the parsing completes or the process times out.\nThis vulnerability is particularly severe because the payload does not need to trigger an overflow or memory corruption; it merely leverages the computational complexity of the parser to induce a performance-based denial of service. The lack of an upper limit on the number of fields makes the application a target for simple, low-effort resource exhaustion attacks.\nPost-exploitation impact includes sustained downtime for the application, potential degradation of services relying on the same event loop, and an inability for the server to recover while the event loop is saturated with the malicious parsing task."
}