Sign in
Deutsch English Español Polski
High

Tornado: Quadratic DoS via Crafted Multipart Parameters

  • Disclosed: 12.12.2025
  • Updated: 11.10.2026 14:18

Summary

The _parseparam function in Tornado's httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data. This function uses an inefficient algorithm that repeatedly calls string.count() within a nested loop while processing quoted semicolons (e.g., param=";").

As a result, if an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period, leading to a Denial of Service (DoS).

Severity: High

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) tornado < 6.5.3 6.5.3

References

CVSS score 7.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE)
CWE-400
Platform
Python (PyPI)
Package
tornado
Disclosed
12.12.2025
Updated
11.10.2026 14:18

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2025-267 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-jhmp-mqwm-3gq8 - CC BY 4.0

Vulnerability history: tornado

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (23) in the archive
Total entries
23
First → latest
05.2012 09.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • High 13
  • Medium 8
  • Low 2

Disclosures per year

earlier: 1

Severity:
  1. tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
    High · 7.5 CVE-2026-103262 < 6.5.9 6.5.9
  2. Tornado: StaticFileHandler follows symlinks outside static root (path traversal)
    High CVE-2026-103263 < 6.5.9 6.5.9
  3. Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
    High · 7.5 CVE-2026-82397 < 6.5.8 6.5.8
  4. Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
    High · 7.7 CVE-2026-49853 < 6.5.6 6.5.6
  5. tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)
    High · 7.5 CVE-2026-49855 < 6.5.6 6.5.6
  6. Tornado has cookie attribute injection via .RequestHandler.set_cookie
    High · 7.2 CVE-2026-35536 < 6.5.5 6.5.5
  7. Tornado is vulnerable to DoS due to too many multipart parts
    High · 7.5 CVE-2026-31958 < 6.5.5 6.5.5
  8. Tornado: Quadratic DoS via Crafted Multipart Parameters this entry
    High · 7.5 CVE-2025-67726 < 6.5.3 6.5.3
  9. Tornado: Quadratic DoS via Repeated Header Coalescing
    High · 7.5 CVE-2025-67725 < 6.5.3 6.5.3
  10. Tornado vulnerable to excessive logging caused by malformed multipart form data
    High · 7.5 CVE-2025-47287 < 6.5 6.5
  11. Tornado has an HTTP cookie parsing DoS vulnerability
    High · 7.5 CVE-2024-52804 < 6.4.2 6.4.2
  12. Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determin
    High · 6.5 CVE-2014-9720 < 3.2.2 3.2.2
  13. CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting
    High · 7.5 CVE-2012-2374 < 2.2.1 2.2.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.