CVE-2026-82397

Tornado versions prior to 6.5.8 parse application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs without passing the max_num_fields limit, leaving the number of parameters in a request body effectively unbounded. Because RequestHandler parses the body before dispatching to the application handler, any unauthenticated client can send a POST whose body — bounded only by the default 100 MB max_buffer_size — contains millions of separator-delimited fields. Parsing such a body synchronously stalls Tornado's single-threaded event loop, delaying every connection served by that process, so the attacker gains a full denial of service with no confidentiality or integrity impact (CVSS 7.5, availability-only). Any Python service built on Tornado that accepts urlencoded POST bodies from unauthenticated users is affected, including widely deployed Tornado-based applications such as Jupyter-style services. No public proof-of-concept or in-the-wild exploitation is known; EPSS assigns a 0.4% probability of exploitation within 30 days and the issue is not in CISA KEV.

What to do: Upgrade Tornado to 6.5.8 or later. As interim mitigation, reduce max_buffer_size/max_body_size well below the 100 MB default, enforce a field-count or body-size cap at a reverse proxy or load balancer in front of Tornado services, and inventory which Tornado-based services accept unauthenticated POST bodies and prioritize upgrading internet-exposed ones.