high · 7.5CVE-2026-82397Sep 2, 2026

CVE-2026-82397: tornado Urlencoded Body Parsing DoS via Unbounded Field Count

Shubham Kandhare
Security Engagement Manager, SecureLayer7

Any unauthenticated attacker can send a single large form-encoded HTTP request to a Tornado server and freeze it completely, because Tornado parses the body synchronously on the event loop with no…

Packagetornado
Ecosystempip
Affected<= 6.5.7
Fixed in6.5.8
CVE-2026-82397: tornado Urlencoded Body Parsing DoS via Unbounded Field Count

The problem

Tornado passes application/x-www-form-urlencoded request bodies to urllib.parse.parse_qs in tornado/escape.py without the max_num_fields argument.

The parse runs synchronously on the event loop before any handler code executes, and the only size bound is max_buffer_size, which defaults to 100 MB. A 100 MB body of & separators produces roughly fifty million empty fields. Every other connection waits for the entire parse to finish.

Proof of concept

A working proof-of-concept for CVE-2026-82397 in tornado, with the exact payload below.

http
POST /any-form-endpoint HTTP/1.1
Host: target:8888
Content-Type: application/x-www-form-urlencoded
Content-Length: 104857600

&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&[...100 MB of '&' characters...]

CPython added max_num_fields to parse_qs specifically to prevent this class of attack. When the argument is omitted, there is no field-count ceiling, so the only limit is memory and CPU time.

The patch (commit 8d6363e, PR #3704) adds max_num_fields to the parse_qs call in tornado/escape.py and threads a configurable default through parse_qs_bytes in tornado/httputil.py. CPython raises ValueError when the limit is exceeded, which the fix maps to an HTTP 400 response.

Root cause is CWE-400 (Uncontrolled Resource Consumption) combined with CWE-1284 (Improper Validation of Specified Quantity in Input).

The fix

Upgrade tornado to 6.5.8 or later. The patched release adds a max_num_fields cap to the urlencoded body parser and returns HTTP 400 when a request exceeds it. No configuration change is needed after upgrading, though applications processing unusually large forms can raise the limit explicitly.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research