CVE-2026-91990

Tornado, a widely used asynchronous Python web framework, contains a memory amplification vulnerability in its parse_multipart_form_data function in all versions before 6.5.8. The flaw occurs because multipart request data is split into parts before the configured max_parts limit is enforced, so an unauthenticated attacker can send a crafted multipart request containing a very large number of parts, causing the server to build large transient lists in memory. Successful exploitation exhausts server memory and produces denial of service, with no impact on confidentiality or integrity (CVSS 4.0: 8.7, driven entirely by availability). Any application built on an affected Tornado release that accepts multipart form data (e.g., file uploads) from untrusted clients is exposed. No public proof of concept exists and the vulnerability is not listed in CISA's KEV, so exploitation in the wild is not currently indicated.

What to do: Upgrade to Tornado 6.5.8 or later, which validates the max_parts limit before splitting multipart data. If immediate patching is not possible, place a reverse proxy or WAF in front to cap request body size and rate-limit multipart requests per client. Audit any Tornado-based endpoints that accept file uploads or multipart form data, since exploitation requires no authentication and leaves few traces beyond memory pressure and OOM crashes.