SUSE-SU-2026:20761-1 Security update for python-tornado6

This update for python-tornado6 fixes the following issues: - CVE-2026-31958: parsing large multipart bodies with many parts can cause a denial of service bsc1259553. - incomplete validation of cookie attributes allows for injection of user-controlled values in other cookie attributes bsc1259630...

OPENSUSE-SU-2026:20406-1 Security update for python-tornado6

This update for python-tornado6 fixes the following issues: - CVE-2026-31958: parsing large multipart bodies with many parts can cause a denial of service bsc1259553. - incomplete validation of cookie attributes allows for injection of user-controlled values in other cookie attributes bsc1259630...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: pcs (UTSA-2026-006185)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006185 advisory. Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form- data parser encounters certain errors, it logs a warning but...

Denial Of Service (DoS)

Tornado is vulnerable to Denial of Service DoS. The vulnerability is due to synchronous parsing of multipart/form-data without limiting the number of parts, allowing attackers to send large requests with many parts that consume excessive CPU and block the main thread...

OPENSUSE-SU-2026:10374-1 python311-tornado6-6.5.5-1.1 on GA media

These are all security issues fixed in the python311-tornado6-6.5.5-1.1 package on the GA media of openSUSE Tumbleweed...

a-mailx (=0.1.0), abracadabra (>=0.0.0 <=0.0.7) +887 more potentially affected by CVE-2026-31958 via tornado (>=3.0.0 <=6.5.4)

tornado PYPI version =3.0.0, =0.0.0, =0.0.3, =0.0.5, =1.0.0, =1.0.0, =0.31.0, =1.0.0, =1.3.0, =3.3.3, =0.1.23, =0.0.9.1, =0.20.0, =0.21.0 and more Source cves: CVE-2026-31958 Source advisory: OSV:GHSA-QJXF-F2MG-C6MC...

EUVD-2026-11323

Tornado is vulnerable to DoS due to too many multipart parts...

Tornado is vulnerable to DoS due to too many multipart parts

In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the maxbodysize setting default 100MB. Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart...

GHSA-QJXF-F2MG-C6MC Tornado is vulnerable to DoS due to too many multipart parts

In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the maxbodysize setting default 100MB. Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart...

SUSE CVE-2026-31958

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the maxbodysize setting default 100MB. Since parsing occurs synchronously on the main thread, this creates the possibility ...

The vulnerability of the _parseparam function in the httputil.py component of the Python Tornado web framework, which allows a hacker to cause a denial-of-service attack.

The vulnerability of the parseparam function in the httputil.py component of the Python Tornado web framework involves an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

a-mailx (=0.1.0), abracadabra (>=0.0.0 <=0.0.7) +887 more potentially affected by unknown CVE via tornado (>=3.0.0 <=6.5.4)

tornado PYPI version =3.0.0, =0.0.0, =0.0.3, =0.0.5, =1.0.0, =1.0.0, =0.31.0, =1.0.0, =1.3.0, =3.3.3, =0.1.23, =0.0.9.1, =0.20.0, =0.21.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-78CV-MQJ4-43F7...

Parameter Injection

Overview tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. Affected versions of this package are vulnerable to Parameter Injection in the setcookie function in web.py‎. An attacker can manipulate cookie attributes by injecting values after ...

Tornado has incomplete validation of cookie attributes

Values passed to the domain, path, and samesite arguments of RequestHandler.setcookie were not completely validated in versions of Tornado prior to 6.5.5. In particular, semicolons would be allowed, which could be used to inject attacker-controlled values for other cookie attributes...

a-mailx (=0.1.0), abracadabra (>=0.0.0 <=0.0.7) +656 more potentially affected by CVE-2026-35536 via tornado (>=6.0.0 <=6.5.4)

tornado PYPI version =6.0.0, =0.0.0, =0.7.3, =0.0.5, =1.0.0, =1.0.0, =0.31.0, =1.3.0, =0.1.23, =0.0.9.1, =0.20.0, =0.9.5, =22.5.13, =26.2.0 and more Source cves: CVE-2026-35536 Source advisory: SNYK:PYTHON-TORNADO-15467448...

a-mailx (=0.1.0), abracadabra (>=0.0.0 <=0.0.7) +656 more potentially affected by CVE-2026-31958 via tornado (>=6.0.0 <=6.5.4)

tornado PYPI version =6.0.0, =0.0.0, =0.7.3, =0.0.5, =1.0.0, =1.0.0, =0.31.0, =1.3.0, =0.1.23, =0.0.9.1, =0.20.0, =0.9.5, =22.5.13, =26.2.0 and more Source cves: CVE-2026-31958 Source advisory: SNYK:PYTHON-TORNADO-15467447...

Allocation of Resources Without Limits or Throttling

Overview tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling during the parsing of multipart/form-data bodies containing an excessive...

PYSEC-2026-140

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the maxbodysize setting default 100MB. Since parsing occurs synchronously on the main thread, this creates the possibility ...

a-mailx (=0.1.0), abracadabra (>=0.0.0 <=0.0.7) +887 more potentially affected by CVE-2026-31958 via tornado (>=3.0.0 <=6.5.4)

tornado PYPI version =3.0.0, =0.0.0, =0.0.3, =0.0.5, =1.0.0, =1.0.0, =0.31.0, =1.0.0, =1.3.0, =3.3.3, =0.1.23, =0.0.9.1, =0.20.0, =0.21.0 and more Source cves: CVE-2026-31958 Source advisory: OSV:PYSEC-2026-140...

CVE-2026-31958

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the maxbodysize setting default 100MB. Since parsing occurs synchronously on the main thread, this creates the possibility ...