CVE-2026-103261

Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.init, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts ...

EUVD-2026-90655

Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.init, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts ...

CVE-2026-103261

The Tornado web framework versions prior to 6.5.9 are vulnerable to a Denial of Service (DoS) condition. The root cause is a lack of limits on the number of query string fields processed within the HTTPServerRequest.__init__ component. A remote, unauthenticated attacker can exploit this by sendin...

CVE-2026-103261 Tornado before 6.5.9 Denial of Service via Query String

Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.init, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts ...

Tornado: Unbounded query-string argument count allows event-loop-stalling DoS

Summary HTTPServerRequest.init in tornado/httputil.py parses the URL query string via parseqsbytes with no field-count limit — while the sibling POST-body parsing path parsebodyarguments received a maxnumfields=1000 cap added earlier in this exact same release v6.5.8, commit 8d6363ed, explicitly ...