CVE-2026-82397

A flaw was found in Tornado. An unauthenticated remote attacker could send a specially crafted request with a large number of fields in the URL-encoded body. This could cause the single-threaded event loop to stall, leading to a Denial of Service (DoS) for all connections. The vulnerability occurs because the urllib.parse.parse_qs function is used without limiting the maximum number of fields.

A flaw was found in Tornado's request body parsing mechanism. When processing application/x-www-form-urlencoded HTTP request bodies, Tornado invokes urllib.parse.parse_qs without specifying max_num_fields. An unauthenticated remote attacker can send an HTTP request with an excessively large number of form field key-value pairs. Parsing these fields synchronously blocks Tornado's single-threaded event loop, leading to a complete denial of service for all concurrent connections and incoming requests.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict request payload sizes or maximum form field counts at an upstream web application firewall (WAF) or reverse proxy layer before HTTP requests reach the Tornado application worker.