{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/tornado--6.5.7/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:tornado:tornado:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-82397"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Tornado (\u003c= 6.5.7)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","web-application","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Tornado"],"content_html":"\u003cp\u003eTornado versions 6.5.7 and earlier are vulnerable to a denial-of-service (DoS) condition due to how they process application/x-www-form-urlencoded request bodies. The web framework utilizes \u003ccode\u003eurllib.parse.parse_qs\u003c/code\u003e to decode incoming form data but fails to implement the \u003ccode\u003emax_num_fields\u003c/code\u003e parameter introduced in CPython. Because Tornado is single-threaded and executes this parsing synchronously on the event loop before reaching the application handler, an attacker can send a crafted request body containing tens of millions of field separators. This forces the server process to expend significant CPU cycles on parsing, effectively stalling the event loop and blocking all other concurrent connections. The issue is exacerbated by the default 100 MB request body limit, which provides ample space for an attacker to include roughly fifty million fields in a single HTTP POST request. This vulnerability is pre-dispatch and requires no authentication, making it a critical risk for internet-facing Tornado applications.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an internet-facing endpoint running a vulnerable Tornado version that accepts POST requests with application/x-www-form-urlencoded content.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious HTTP POST request body consisting of a large sequence (up to 100 MB) of delimiter characters (e.g., ampersands) to maximize the number of fields.\u003c/li\u003e\n\u003cli\u003eThe request is transmitted to the target Tornado server.\u003c/li\u003e\n\u003cli\u003eThe Tornado HTTP server reads the full request body up to the configured \u003ccode\u003emax_buffer_size\u003c/code\u003e (default 100 MB).\u003c/li\u003e\n\u003cli\u003eThe server executes \u003ccode\u003etornado.web.RequestHandler._execute\u003c/code\u003e, which triggers the synchronous \u003ccode\u003e_parse_body\u003c/code\u003e routine within the event loop.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eparse_qs_bytes\u003c/code\u003e function attempts to parse the unbounded number of fields using \u003ccode\u003eurllib.parse.parse_qs\u003c/code\u003e without a limit.\u003c/li\u003e\n\u003cli\u003eThe process consumes high CPU while parsing the millions of fields, causing the event loop to hang and ceasing all processing of other legitimate client connections.\u003c/li\u003e\n\u003cli\u003eThe server remains in an unresponsive state until the malicious parsing completes or the process is manually restarted.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a complete denial-of-service for the affected Tornado server process. Since the event loop is blocked synchronously, all legitimate users of the service will experience timeouts or connection resets. This affects any application running on Tornado that accepts POST requests, which is standard for web services, and can be executed by any unauthenticated remote attacker.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade to a version of Tornado that includes a fix for CVE-2026-82397 (future release beyond 6.5.7).\u003c/li\u003e\n\u003cli\u003eImplement an application-level wrapper or middleware to validate the size and complexity of request bodies before they reach the framework's parser.\u003c/li\u003e\n\u003cli\u003eReview and reduce the \u003ccode\u003emax_buffer_size\u003c/code\u003e and request body limits for routes that do not require 100 MB of form data to mitigate the maximum possible input size for the parser.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-02T18:04:24Z","date_published":"2026-09-02T18:04:24Z","id":"https://feed.craftedsignal.io/briefs/2026-09-tornado-dos/","summary":"Tornado fails to restrict the number of fields parsed in application/x-www-form-urlencoded request bodies, allowing an unauthenticated attacker to cause a denial-of-service by stalling the event loop.","title":"Denial of Service in Tornado via Unbounded Form Field Parsing","url":"https://feed.craftedsignal.io/briefs/2026-09-tornado-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Tornado (\u003c= 6.5.7)","version":"https://jsonfeed.org/version/1.1"}