Skip to content
OpenAdvisories
High · 8.7 CVE-2026-31958 EUVD-2026-11323GHSA-qjxf-f2mg-c6mcPYSEC-2026-140

Tornado has a DoS due to too many multipart parts

Published Mar 11, 2026 · Updated Apr 1, 2026 · Assigned by GitHub_M

Description

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.

Affected products

VendorProductAffectedFixed
tornadoweb tornado < 6.5.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 python-tornado 6.5.5-1 —
Debian 13 python-tornado No fix yet —
Debian 12 python-tornado No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS python-tornado 6.5.4-0.1ubuntu0.1 —
Ubuntu 25.10 python-tornado 6.4.2-3ubuntu0.3 —
Ubuntu 24.04 LTS python-tornado 6.4.0-1ubuntu0.5 —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS python-tornado 6.1.0-3ubuntu0.1~esm5 —
Ubuntu Pro 18.04 LTS python-tornado 4.5.3-1ubuntu0.2+esm3 —
Ubuntu Pro 16.04 LTS python-tornado 4.2.1-1ubuntu3.1+esm3 —
ReleasePackageFixed inAdvisory
RHEL 10 python-tornado +1 6.5.5-1.el10_1.1 RHSA-2026:19034, RHSA-2026:13641
RHEL 9 python-tornado +1 6.5.5-1.el9_7.1 RHSA-2026:19189, RHSA-2026:13670
RHEL 8 pcs +1 0.10.18-2.el8_10.9 RHSA-2026:8093
Show 12 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS python-tornado +1 6.4.2-1.el10_0.2 RHSA-2026:20577
RHEL 9.6 EUS python-tornado +1 6.4.2-2.el9_6.3 RHSA-2026:20572
RHEL 9.4 EUS python-tornado +1 6.4.2-1.el9_4.2 RHSA-2026:20810
RHEL 9.2 E4S python-tornado +1 6.4.2-1.el9_2.2 RHSA-2026:20573
RHEL 9.0 E4S pcs +1 0.11.1-10.el9_0.11 RHSA-2026:11454
RHEL 8.8 TUS pcs +1 0.10.15-4.el8_8.11 RHSA-2026:11495
RHEL 8.8 E4S pcs +1 0.10.15-4.el8_8.11 RHSA-2026:11495
RHEL 8.6 TUS pcs +1 0.10.12-6.el8_6.13 RHSA-2026:11494
RHEL 8.6 E4S pcs +1 0.10.12-6.el8_6.13 RHSA-2026:11494
RHEL 8.4 EUS Long Life pcs +1 0.10.8-1.el8_4.11 RHSA-2026:11493
RHEL 8.4 AUS pcs +1 0.10.8-1.el8_4.11 RHSA-2026:11493
RHEL 7 ELS python-tornado +1 4.2.1-5.el7_9.3 RHSA-2026:24342

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 python3-tornado 6.5.5-1.el10_1.1 ALSA-2026:19034, ALSA-2026:13641
AlmaLinux 9 python3-tornado 6.5.5-1.el9_7.1 ALSA-2026:19189, ALSA-2026:13670
AlmaLinux 8 pcs +1 0.10.18-2.el8_10.9.alma.1 ALSA-2026:8093

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 python-tornado 6.5.5-1.el10_1.1 RLSA-2026:19034, RLSA-2026:13641
Rocky Linux 9 python-tornado 6.5.5-1.el9_7.1 RLSA-2026:19189, RLSA-2026:13670
Rocky Linux 8 pcs 0.10.18-2.el8_10.9 RLSA-2026:8093
ReleasePackageFixed inAdvisory
SLES 15 SP7 python-tornado 4.5.3-150000.3.19.1 SUSE-SU-2026:1171-1
SLES 15 SP6 python-tornado 4.5.3-150000.3.19.1 SUSE-SU-2026:1171-1
SLES 15 SP6 python-tornado6 6.3.2-150400.9.15.1 SUSE-SU-2026:1064-1
SLES 15 SP5 python-tornado 4.5.3-150000.3.19.1 SUSE-SU-2026:1171-1
SLES 15 SP5 python-tornado6 6.3.2-150400.9.15.1 SUSE-SU-2026:1064-1
SLES 15 SP4 python-tornado 4.5.3-150000.3.19.1 SUSE-SU-2026:1171-1
SLES 15 SP4 python-tornado6 6.3.2-150400.9.15.1 SUSE-SU-2026:1064-1
SLES 3 python-tornado6 6.3.2-150400.9.15.1 SUSE-SU-2026:1064-1
Show 25 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 python-tornado6 6.5-160000.4.1 SUSE-SU-2026:20919-1
SLES for SAP 15 SP6 python-tornado 4.5.3-150000.3.19.1 SUSE-SU-2026:1171-1
SLES for SAP 15 SP6 python-tornado6 6.3.2-150400.9.15.1 SUSE-SU-2026:1064-1
SLES for SAP 15 SP5 python-tornado 4.5.3-150000.3.19.1 SUSE-SU-2026:1171-1
SLES for SAP 15 SP5 python-tornado6 6.3.2-150400.9.15.1 SUSE-SU-2026:1064-1
SLES for SAP 15 SP4 python-tornado 4.5.3-150000.3.19.1 SUSE-SU-2026:1171-1
SLES for SAP 15 SP4 python-tornado6 6.3.2-150400.9.15.1 SUSE-SU-2026:1064-1
SLES 16.0 python-tornado6 6.5-160000.4.1 SUSE-SU-2026:20919-1
SLE Micro 6.2 python-tornado6 6.5-160000.4.1 SUSE-SU-2026:20761-1
SLE Micro 6.1 python-tornado6 6.4-slfo.1.1_4.1 SUSE-SU-2026:20770-1
SLE Micro 6.0 python-tornado6 6.4-5.1 SUSE-SU-2026:20797-1
SLE Micro 5.5 python-tornado 4.5.3-150000.3.19.1 SUSE-SU-2026:1171-1
SLE Micro 5.4 python-tornado 4.5.3-150000.3.19.1 SUSE-SU-2026:1171-1
SLE Micro 5.3 python-tornado 4.5.3-150000.3.19.1 SUSE-SU-2026:1171-1
SLE Micro 5.2 python-tornado 4.5.3-150000.3.19.1 SUSE-SU-2026:1171-1
SLE HPC 15 SP5 python-tornado 4.5.3-150000.3.19.1 SUSE-SU-2026:1171-1
SLE HPC 15 SP5 python-tornado6 6.3.2-150400.9.15.1 SUSE-SU-2026:1064-1
SLE HPC 15 SP4 python-tornado 4.5.3-150000.3.19.1 SUSE-SU-2026:1171-1
SLE HPC 15 SP4 python-tornado6 6.3.2-150400.9.15.1 SUSE-SU-2026:1064-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update golang-github-lusitaniae-apache_exporter 1.0.10-80002.3.6.2 SUSE-SU-2026:1520-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy +1 3.11.13-80002.4.9.2 SUSE-SU-2026:1520-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-m2crypto 0.45.1-80002.3.9.2 SUSE-SU-2026:1520-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pyzmq 25.1.2-80002.3.9.2 SUSE-SU-2026:1520-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-simplejson 3.19.1-80002.3.6.2 SUSE-SU-2026:1520-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-tornado 6.3.2-80002.4.6.2 SUSE-SU-2026:1520-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update spacecmd 5.1.13-80002.3.9.2 SUSE-SU-2026:1520-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update uyuni-tools 5.1.26-80002.3.9.2 SUSE-SU-2026:1520-1
SUSE RES-8:Update:Products:MultiLinuxManagerTools:Update venv-salt-minion 3006.0-80002.5.12.3 SUSE-SU-2026:1520-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update golang-github-lusitaniae-apache_exporter 1.0.10-70002.3.6.1 SUSE-SU-2026:1521-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy +1 3.11.13-70002.4.9.1 SUSE-SU-2026:1521-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-m2crypto 0.45.1-70002.3.9.2 SUSE-SU-2026:1521-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pyzmq 25.1.2-70002.3.9.2 SUSE-SU-2026:1521-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-simplejson 3.19.1-70002.3.6.2 SUSE-SU-2026:1521-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-tornado 6.3.2-70002.4.6.1 SUSE-SU-2026:1521-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update spacecmd 5.1.13-70002.3.9.1 SUSE-SU-2026:1521-1
SUSE RES-7:Update:Products:MultiLinuxManagerTools:Update venv-salt-minion 3006.0-70002.5.12.1 SUSE-SU-2026:1521-1
SUSE Multi Linux Manager Tools SLE-Micro-5 venv-salt-minion 3006.0-150002.5.12.2 SUSE-SU-2026:1525-1
SUSE Multi Linux Manager Tools SLE-15 venv-salt-minion 3006.0-150002.5.12.2 SUSE-SU-2026:1525-1
SUSE Multi Linux Manager Tools SLE-12 venv-salt-minion 3006.0-120002.5.12.1 SUSE-SU-2026:1523-1
SUSE Multi Linux Manager Tools RES-7 golang-github-lusitaniae-apache_exporter 1.0.10-70002.3.6.1 SUSE-SU-2026:1521-1
SUSE Multi Linux Manager Tools RES-7 spacecmd 5.1.13-70002.3.9.1 SUSE-SU-2026:1521-1
SUSE Multi Linux Manager Tools RES-7 venv-salt-minion 3006.0-70002.5.12.1 SUSE-SU-2026:1521-1
SUSE Multi Linux Manager Tools EL-9 golang-github-lusitaniae-apache_exporter 1.0.10-90002.3.6.1 SUSE-SU-2026:1519-1
SUSE Multi Linux Manager Tools EL-9 spacecmd 5.1.13-90002.3.9.1 SUSE-SU-2026:1519-1
SUSE Multi Linux Manager Tools EL-9 uyuni-tools 5.1.26-90002.3.9.1 SUSE-SU-2026:1519-1
SUSE Multi Linux Manager Tools EL-9 venv-salt-minion 3006.0-90002.5.12.2 SUSE-SU-2026:1519-1
SUSE Multi Linux Manager Tools EL-8 golang-github-lusitaniae-apache_exporter 1.0.10-80002.3.6.2 SUSE-SU-2026:1520-1
SUSE Multi Linux Manager Tools EL-8 spacecmd 5.1.13-80002.3.9.2 SUSE-SU-2026:1520-1
SUSE Multi Linux Manager Tools EL-8 uyuni-tools 5.1.26-80002.3.9.2 SUSE-SU-2026:1520-1
SUSE Multi Linux Manager Tools EL-8 venv-salt-minion 3006.0-80002.5.12.3 SUSE-SU-2026:1520-1
SUSE Manager Client Tools for RHEL, Liberty and Clones 9 venv-salt-minion 3006.0-1.76.1 SUSE-EL-9-CLIENT-TOOLS-2026-2255
SUSE Manager Client Tools 12 python-tornado 4.2.1-17.18.1 SUSE-SU-2026:1162-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update golang-github-lusitaniae-apache_exporter 1.0.10-90002.3.6.1 SUSE-SU-2026:1519-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy +1 3.11.13-90002.4.9.1 SUSE-SU-2026:1519-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-m2crypto 0.45.1-90002.3.9.2 SUSE-SU-2026:1519-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-pyzmq 25.1.2-90002.3.9.1 SUSE-SU-2026:1519-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-simplejson 3.19.1-90002.3.6.1 SUSE-SU-2026:1519-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update saltbundlepy-tornado 6.3.2-90002.4.6.2 SUSE-SU-2026:1519-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update spacecmd 5.1.13-90002.3.9.1 SUSE-SU-2026:1519-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update uyuni-tools 5.1.26-90002.3.9.1 SUSE-SU-2026:1519-1
SUSE EL-9:Update:Products:MultiLinuxManagerTools:Update venv-salt-minion 3006.0-90002.5.12.2 SUSE-SU-2026:1519-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python-tornado6 6.5.5-1.1 openSUSE-SU-2026:10374-1
openSUSE Tumbleweed salt 3006.0-56.1 openSUSE-SU-2026:10389-1
openSUSE Leap 16.0 python-tornado6 6.5-160000.4.1 openSUSE-SU-2026:20406-1
openSUSE Leap 16.0 salt +1 3006.0-160000.5.1 openSUSE-SU-2026:20918-1
openSUSE Leap 15.6 python-tornado6 6.3.2-150400.9.15.1 SUSE-SU-2026:1064-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 python3-tornado +1 6.1.0-2.amzn2023.0.7 ALAS2023-2026-1502
Amazon Linux 2023 python3.13-tornado +1 6.4.2-1.amzn2023.0.2 ALAS2023-2026-1528
Amazon Linux 2 python-tornado +1 4.2.1-3.amzn2.0.4 ALAS2-2026-3214
Amazon Linux 2 python3-tornado +1 5.0.2-4.amzn2.0.7 ALAS2-2026-3213

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 python3-tornado 6.5.5-1.el10_1.1 ELSA-2026-19034, ELSA-2026-13641
Oracle Linux 9 python3-tornado 6.5.5-1.el9_7.1 ELSA-2026-19189, ELSA-2026-13670
Oracle Linux 8 pcs +1 0.10.18-2.0.1.el8_10.9 ELSA-2026-8093
Oracle Linux 7 python-tornado +1 4.2.1-5.0.3.el7 ELSA-2026-24342

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling airflow-3 3.1.8-r2 —
Wolfi rolling dask-kubernetes 2026.3.0-r1 —
Wolfi rolling kubeflow-pipelines-visualization-server 2.16.0-r2 —
Wolfi rolling mitmproxy 12.2.2-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI tornado < 6.5.5 6.5.5 GHSA-qjxf-f2mg-c6mc

Advisories 50

References