Sign in
Deutsch English Español Polski
Medium

tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

  • Disclosed: 01.09.2026
  • Updated: 11.10.2026 15:18

Description

Summary

parse_multipart_form_data (httputil.py:34) calls data.split(b"--"+boundary+b"\r\n") before the max_parts check (:35). A 600KB body with 100k parts creates a 100k-element transient list first, then rejects transient memory amplification (each split element is a copy). Pre-auth HTTP DoS.

Root cause

python
parts = data[:final_boundary_index].split(b"--" + boundary + b"\r\n")  # :34  huge list first
if len(parts) > config.max_parts:                                       # :35  check after
    raise HTTPInputError("multipart/form-data has too many parts")

PoC

gist: https://gist.github.com/afldl/649861f25d39b53b7edbe0298e171617 poc.py + output.txt (100k parts from 600KB transient list).

Fix

Count separators without materializing the list (e.g. data.count(b"--"+boundary) first).

Credit

Reported by afldl, 2026-07.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) tornado < 6.5.8 6.5.8

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness (CWE)
CWE-770
Platform
Python (PyPI)
Package
tornado
Disclosed
01.09.2026
Updated
11.10.2026 15:18

Sources and licenses

OSV / GitHub Advisory Database - GHSA-8423-8fgw-73vq - CC BY 4.0

Vulnerability history: tornado

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (23) in the archive
Total entries
23
First → latest
05.2012 09.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • High 13
  • Medium 8
  • Low 2

Disclosures per year

earlier: 1

Severity:
  1. tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
    High · 7.5 CVE-2026-103262 < 6.5.9 6.5.9
  2. Tornado: StaticFileHandler follows symlinks outside static root (path traversal)
    High CVE-2026-103263 < 6.5.9 6.5.9
  3. Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
    High · 7.5 CVE-2026-82397 < 6.5.8 6.5.8
  4. tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34) this entry
    Medium CVE-2026-91990 < 6.5.8 6.5.8
  5. Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
    High · 7.7 CVE-2026-49853 < 6.5.6 6.5.6
  6. tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)
    High · 7.5 CVE-2026-49855 < 6.5.6 6.5.6
  7. Tornado has cookie attribute injection via .RequestHandler.set_cookie
    High · 7.2 CVE-2026-35536 < 6.5.5 6.5.5
  8. Tornado is vulnerable to DoS due to too many multipart parts
    High · 7.5 CVE-2026-31958 < 6.5.5 6.5.5
  9. Tornado: Quadratic DoS via Crafted Multipart Parameters
    High · 7.5 CVE-2025-67726 < 6.5.3 6.5.3
  10. Tornado: Quadratic DoS via Repeated Header Coalescing
    High · 7.5 CVE-2025-67725 < 6.5.3 6.5.3
  11. Tornado vulnerable to excessive logging caused by malformed multipart form data
    High · 7.5 CVE-2025-47287 < 6.5 6.5
  12. Tornado has an HTTP cookie parsing DoS vulnerability
    High · 7.5 CVE-2024-52804 < 6.4.2 6.4.2
  13. Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determin
    High · 6.5 CVE-2014-9720 < 3.2.2 3.2.2
  14. CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting
    High · 7.5 CVE-2012-2374 < 2.2.1 2.2.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.