CVE-2026-103261

A flaw was found in Tornado. When processing incoming HTTP requests, Tornado fails to restrict the number of parameters parsed from the URL query string. A remote, unauthenticated attacker could exploit this flaw by sending requests with an excessive number of query parameters, leading to high CPU consumption that stalls the application's event loop. This results in a Denial of Service (DoS), significantly degrading response times for all clients sharing the same server process.

A denial-of-service flaw of moderate impact was found in Tornado, a Python web framework and asynchronous networking library used by several Red Hat offerings, including Red Hat Enterprise Linux (pcs), Red Hat OpenShift Container Platform, and Fedora/EPEL community components. When processing incoming HTTP requests, Tornado does not limit the number of parameters parsed from the URL query string, although the equivalent POST-body parsing path is capped. A remote, unauthenticated attacker could send GET requests containing an excessive number of query parameters; parsing them is CPU-intensive work performed synchronously on the single-threaded event loop, which stalls the loop and significantly degrades response times for all clients sharing the same server process. The flaw affects availability only, with no confidentiality or integrity impact. Red Hat rates this flaw Moderate severity with CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), consistent with the upstream assessment. For Red Hat Enterprise Linux and OpenShift Container Platform, fixes are deferred because this Moderate-severity flaw has a CVSS score below 7.0 and no tracker is filed at that priority; the residual risk is degraded responsiveness of network-exposed Tornado-based services. For Fedora and EPEL community components, resolution is delegated to the community maintainers and a fix is being pursued.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.