VDB
CVE-2026-91990
CVE-2026-91990
PUBLISHED
CVSS 8.7 HIGH
Reported by VulnCheck · Published September 15, 2026
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.
Risk Scores
CVSS 4.0
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| tornadoweb | tornado | 0, 6.5.8 |
| tornadoweb | tornado | |
| tornadoweb | tornado | 0, 6.5.8, 0 |
Timeline
- Sep 15, 2026 Coalition ESS Score
- Sep 15, 2026 CVE Published
- Sep 15, 2026 CVE Updated
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
- Sep 26, 2026 EPSS Score
- Sep 30, 2026 EPSS Score
- Oct 2, 2026 EPSS Score
- Oct 3, 2026 EPSS Score
- Oct 6, 2026 EPSS Score
- Oct 8, 2026 EPSS Score
References
- GitHub Security Advisory (GHSA-8423-8fgw-73vq) vendor-advisory
- VulnCheck Advisory: Tornado before 6.5.8 Memory Amplification DoS via multipart third-party-advisory