OESA-2026-3973 python-tornado security update

Tornado is an open source version of the scalable, non-blocking web server and tools. Security Fixes: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape....

OESA-2026-3972 python-tornado security update

Tornado is an open source version of the scalable, non-blocking web server and tools. Security Fixes: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape....

OESA-2026-3971 python-tornado security update

Tornado is an open source version of the scalable, non-blocking web server and tools. Security Fixes: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape....

PYSEC-2026-3928 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Summary Tornado parses application/x-www-form-urlencoded bodies with urllib.parse.parseqs and does not pass maxnumfields. A body made almost entirely of separators produces tens of millions of fields, and the parse happens on the event loop before the handler runs, so a single request stalls the...

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Summary Tornado parses application/x-www-form-urlencoded bodies with urllib.parse.parseqs and does not pass maxnumfields. A body made almost entirely of separators produces tens of millions of fields, and the parse happens on the event loop before the handler runs, so a single request stalls the...

AZL-98544 CVE-2026-82397 affecting package python-tornado 6.3.3-11

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...

FreeBSD : mod_python denial-of-service vulnerability in parse_qs (111)

The following package needs to be updated: modpython %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkg1a448eb7698811d8873f0020ed76ef5a.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright...