CVE-2026-82397: Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
Tornado parses application/x-www-form-urlencoded bodies with urllib.parse.parse_qs and does not pass max_num_fields. A body made almost entirely of separators produces tens of millions of fields, and the parse happens on the event loop before the handler runs, so a single request stalls the whole server.
References
- github.com/advisories/GHSA-mpf4-983q-p7j4
- github.com/tornadoweb/tornado/commit/8d6363ed7b69d5f0da806efe34d256627a2191de
- github.com/tornadoweb/tornado/pull/3704
- github.com/tornadoweb/tornado/releases/tag/v6.5.8
- github.com/tornadoweb/tornado/security/advisories/GHSA-mpf4-983q-p7j4
- nvd.nist.gov/vuln/detail/CVE-2026-82397
Code Behaviors & Features
Detect and mitigate CVE-2026-82397 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →