https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 15:29:51 +0000 https://vulnerability.circl.lu/vuln/bell-cve-2026-82397 <p><strong>Affected:</strong> Alpaquita:25: py3-tornado, Alpaquita:stream: py3-tornado</p> <p><strong>Affected:</strong> Alpaquita:25: py3-tornado, Alpaquita:stream: py3-tornado</p> https://vulnerability.circl.lu/vuln/bell-cve-2026-82397 https://vulnerability.circl.lu/vuln/brew-jupyterlab-cve-2026-82397 <p><strong>Affected:</strong> Homebrew: jupyterlab</p> <p>## Summary</p> <p>Tornado parses `application/x-www-form-urlencoded` bodies with `urllib.parse.parse_qs` and does not pass `max_num_fields`. A body made almost entirely of separators produces tens of millions of fields, and the parse happens on the event loop before the handler runs, so a single request stalls the whole server.</p> <p>## Where it is</p> <p>`tornado/escape.py`, at HEAD `e530031405e2154654dedc4c84d5656b557ea310`:</p> <p>```python result = urllib.parse.parse_qs( qs, keep_blank_values, strict_parsing, encoding=&#34;latin1&#34;, errors=&#34;strict&#34; ) ```</p> <p>`max_num_fields` is the parameter CPython added for exactly this, and it is absent.</p> <p>The path to it is entirely server-side and pre-dispatch. `RequestHandler._execute` parses the body at `tornado/web.py:1821`, which reaches `HTTPServerRequest._parse_body` at `tornado/httputil.py:636`, and the urlencoded branch of `parse_body_arguments` calls `parse_qs_bytes` at `tornado/httputil.py:1030`.</p> <p>The size that reaches it is bounded only by the body cap, which defaults to the stream&#39;s `max_buffer_size` of 104857600 at `tornado/iostream.py:239`, applied as the request body default at `tornado/http1connection.py:136-140`. A 100 MB body of separators is around fifty million fields.</p> <p>## Impact</p> <p>Denial of service against the whole process, not one request. Tornado is single-threaded and the parse is synchronous on the event loop, so every other connection waits. No authentication is needed if any route accepts a form post, which is the normal case.</p> <p>## Sug…</p> <p><strong>Affected:</strong> Homebrew: jupyterlab</p> <p>## Summary</p> <p>Tornado parses `application/x-www-form-urlencoded` bodies with `urllib.parse.parse_qs` and does not pass `max_num_fields`. A body made almost entirely of separators produces tens of millions of fields, and the parse happens on the event loop before the handler runs, so a single request stalls the whole server.</p> <p>## Where it is</p> <p>`tornado/escape.py`, at HEAD `e530031405e2154654dedc4c84d5656b557ea310`:</p> <p>```python result = urllib.parse.parse_qs( qs, keep_blank_values, strict_parsing, encoding=&#34;latin1&#34;, errors=&#34;strict&#34; ) ```</p> <p>`max_num_fields` is the parameter CPython added for exactly this, and it is absent.</p> <p>The path to it is entirely server-side and pre-dispatch. `RequestHandler._execute` parses the body at `tornado/web.py:1821`, which reaches `HTTPServerRequest._parse_body` at `tornado/httputil.py:636`, and the urlencoded branch of `parse_body_arguments` calls `parse_qs_bytes` at `tornado/httputil.py:1030`.</p> <p>The size that reaches it is bounded only by the body cap, which defaults to the stream&#39;s `max_buffer_size` of 104857600 at `tornado/iostream.py:239`, applied as the request body default at `tornado/http1connection.py:136-140`. A 100 MB body of separators is around fifty million fields.</p> <p>## Impact</p> <p>Denial of service against the whole process, not one request. Tornado is single-threaded and the parse is synchronous on the event loop, so every other connection waits. No authentication is needed if any route accepts a form post, which is the normal case.</p> <p>## Sug…</p> https://vulnerability.circl.lu/vuln/brew-jupyterlab-cve-2026-82397 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1233 certfr-2026-avi-1233 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1233 https://vulnerability.circl.lu/vuln/cleanstart-2026-cx71098 <p><strong>Affected:</strong> CleanStart: airflow-3</p> <p>CVE-2026-82397 affects multiple packages. Tornado is a Python web framework and asynchronous networking library. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: airflow-3</p> <p>CVE-2026-82397 affects multiple packages. Tornado is a Python web framework and asynchronous networking library. See references for individual vulnerability details.</p> https://vulnerability.circl.lu/vuln/cleanstart-2026-cx71098 https://vulnerability.circl.lu/vuln/fkie_cve-2026-82397 <p>Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.</p> <p>Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-82397 https://vulnerability.circl.lu/vuln/ghsa-mpf4-983q-p7j4 <p><strong>Affected:</strong> PyPI: tornado</p> <p>## Summary</p> <p>Tornado parses `application/x-www-form-urlencoded` bodies with `urllib.parse.parse_qs` and does not pass `max_num_fields`. A body made almost entirely of separators produces tens of millions of fields, and the parse happens on the event loop before the handler runs, so a single request stalls the whole server.</p> <p>## Where it is</p> <p>`tornado/escape.py`, at HEAD `e530031405e2154654dedc4c84d5656b557ea310`:</p> <p>```python result = urllib.parse.parse_qs( qs, keep_blank_values, strict_parsing, encoding=&#34;latin1&#34;, errors=&#34;strict&#34; ) ```</p> <p>`max_num_fields` is the parameter CPython added for exactly this, and it is absent.</p> <p>The path to it is entirely server-side and pre-dispatch. `RequestHandler._execute` parses the body at `tornado/web.py:1821`, which reaches `HTTPServerRequest._parse_body` at `tornado/httputil.py:636`, and the urlencoded branch of `parse_body_arguments` calls `parse_qs_bytes` at `tornado/httputil.py:1030`.</p> <p>The size that reaches it is bounded only by the body cap, which defaults to the stream&#39;s `max_buffer_size` of 104857600 at `tornado/iostream.py:239`, applied as the request body default at `tornado/http1connection.py:136-140`. A 100 MB body of separators is around fifty million fields.</p> <p>## Impact</p> <p>Denial of service against the whole process, not one request. Tornado is single-threaded and the parse is synchronous on the event loop, so every other connection waits. No authentication is needed if any route accepts a form post, which is the normal case.</p> <p>## Sug…</p> <p><strong>Affected:</strong> PyPI: tornado</p> <p>## Summary</p> <p>Tornado parses `application/x-www-form-urlencoded` bodies with `urllib.parse.parse_qs` and does not pass `max_num_fields`. A body made almost entirely of separators produces tens of millions of fields, and the parse happens on the event loop before the handler runs, so a single request stalls the whole server.</p> <p>## Where it is</p> <p>`tornado/escape.py`, at HEAD `e530031405e2154654dedc4c84d5656b557ea310`:</p> <p>```python result = urllib.parse.parse_qs( qs, keep_blank_values, strict_parsing, encoding=&#34;latin1&#34;, errors=&#34;strict&#34; ) ```</p> <p>`max_num_fields` is the parameter CPython added for exactly this, and it is absent.</p> <p>The path to it is entirely server-side and pre-dispatch. `RequestHandler._execute` parses the body at `tornado/web.py:1821`, which reaches `HTTPServerRequest._parse_body` at `tornado/httputil.py:636`, and the urlencoded branch of `parse_body_arguments` calls `parse_qs_bytes` at `tornado/httputil.py:1030`.</p> <p>The size that reaches it is bounded only by the body cap, which defaults to the stream&#39;s `max_buffer_size` of 104857600 at `tornado/iostream.py:239`, applied as the request body default at `tornado/http1connection.py:136-140`. A 100 MB body of separators is around fifty million fields.</p> <p>## Impact</p> <p>Denial of service against the whole process, not one request. Tornado is single-threaded and the parse is synchronous on the event loop, so every other connection waits. No authentication is needed if any route accepts a form post, which is the normal case.</p> <p>## Sug…</p> https://vulnerability.circl.lu/vuln/ghsa-mpf4-983q-p7j4 https://vulnerability.circl.lu/vuln/oesa-2026-3971 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP3: python-tornado</p> <p>Tornado is an open source version of the scalable, non-blocking web server and tools. Security Fix(es):</p> <p>Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.(CVE-2026-82397)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP3: python-tornado</p> <p>Tornado is an open source version of the scalable, non-blocking web server and tools. Security Fix(es):</p> <p>Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.(CVE-2026-82397)</p> https://vulnerability.circl.lu/vuln/oesa-2026-3971 https://vulnerability.circl.lu/vuln/pysec-2026-3928 <p><strong>Affected:</strong> PyPI: tornado</p> <p>## Summary</p> <p>Tornado parses `application/x-www-form-urlencoded` bodies with `urllib.parse.parse_qs` and does not pass `max_num_fields`. A body made almost entirely of separators produces tens of millions of fields, and the parse happens on the event loop before the handler runs, so a single request stalls the whole server.</p> <p>## Where it is</p> <p>`tornado/escape.py`, at HEAD `e530031405e2154654dedc4c84d5656b557ea310`:</p> <p>```python result = urllib.parse.parse_qs( qs, keep_blank_values, strict_parsing, encoding=&#34;latin1&#34;, errors=&#34;strict&#34; ) ```</p> <p>`max_num_fields` is the parameter CPython added for exactly this, and it is absent.</p> <p>The path to it is entirely server-side and pre-dispatch. `RequestHandler._execute` parses the body at `tornado/web.py:1821`, which reaches `HTTPServerRequest._parse_body` at `tornado/httputil.py:636`, and the urlencoded branch of `parse_body_arguments` calls `parse_qs_bytes` at `tornado/httputil.py:1030`.</p> <p>The size that reaches it is bounded only by the body cap, which defaults to the stream&#39;s `max_buffer_size` of 104857600 at `tornado/iostream.py:239`, applied as the request body default at `tornado/http1connection.py:136-140`. A 100 MB body of separators is around fifty million fields.</p> <p>## Impact</p> <p>Denial of service against the whole process, not one request. Tornado is single-threaded and the parse is synchronous on the event loop, so every other connection waits. No authentication is needed if any route accepts a form post, which is the normal case.</p> <p>## Sug…</p> <p><strong>Affected:</strong> PyPI: tornado</p> <p>## Summary</p> <p>Tornado parses `application/x-www-form-urlencoded` bodies with `urllib.parse.parse_qs` and does not pass `max_num_fields`. A body made almost entirely of separators produces tens of millions of fields, and the parse happens on the event loop before the handler runs, so a single request stalls the whole server.</p> <p>## Where it is</p> <p>`tornado/escape.py`, at HEAD `e530031405e2154654dedc4c84d5656b557ea310`:</p> <p>```python result = urllib.parse.parse_qs( qs, keep_blank_values, strict_parsing, encoding=&#34;latin1&#34;, errors=&#34;strict&#34; ) ```</p> <p>`max_num_fields` is the parameter CPython added for exactly this, and it is absent.</p> <p>The path to it is entirely server-side and pre-dispatch. `RequestHandler._execute` parses the body at `tornado/web.py:1821`, which reaches `HTTPServerRequest._parse_body` at `tornado/httputil.py:636`, and the urlencoded branch of `parse_body_arguments` calls `parse_qs_bytes` at `tornado/httputil.py:1030`.</p> <p>The size that reaches it is bounded only by the body cap, which defaults to the stream&#39;s `max_buffer_size` of 104857600 at `tornado/iostream.py:239`, applied as the request body default at `tornado/http1connection.py:136-140`. A 100 MB body of separators is around fifty million fields.</p> <p>## Impact</p> <p>Denial of service against the whole process, not one request. Tornado is single-threaded and the parse is synchronous on the event loop, so every other connection waits. No authentication is needed if any route accepts a form post, which is the normal case.</p> <p>## Sug…</p> https://vulnerability.circl.lu/vuln/pysec-2026-3928 https://vulnerability.circl.lu/vuln/suse-su-2026:23523-1 <p>Security update for python-tornado6</p> <p>Security update for python-tornado6</p> https://vulnerability.circl.lu/vuln/suse-su-2026:23523-1 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-82397 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-tornado, Ubuntu:Pro:18.04:LTS: python-tornado, Ubuntu:Pro:20.04:LTS: python-tornado, Ubuntu:Pro:22.04:LTS: python-tornado, Ubuntu:24.04:LTS: python-tornado, Ubuntu:26.04:LTS: python-tornado</p> <p>Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-tornado, Ubuntu:Pro:18.04:LTS: python-tornado, Ubuntu:Pro:20.04:LTS: python-tornado, Ubuntu:Pro:22.04:LTS: python-tornado, Ubuntu:24.04:LTS: python-tornado, Ubuntu:26.04:LTS: python-tornado</p> <p>Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-82397