high7.5
CVE-2026-91990
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limi…
Impact
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.
Affected products
| Product | Affected versions |
|---|---|
| Tornado | before 6.5.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.