CVE-2026-91990

A flaw was found in Tornado. This memory amplification vulnerability exists in the parse_multipart_form_data function, where multipart data is processed before validating the maximum number of parts. A remote attacker can exploit this by sending specially crafted multipart requests with numerous parts. This can lead to the creation of large temporary data structures, exhausting server memory and resulting in a Denial of Service (DoS) for the affected system.

This is an Important severity flaw. Applications using the Tornado web framework on Red Hat platforms are vulnerable to a denial of service due to a memory amplification issue in the parse_multipart_form_data function. A remote, unauthenticated attacker can send a crafted multipart request, causing the server to consume excessive memory and become unavailable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.