high 7.5

CVE-2026-91990 json

Tornado before 6.5.8 Memory Amplification DoS via multipart

published 2026-09-01 2 mo ago modified 2026-09-16 53 d ago also GHSA-8423-8fgw-73vq , EUVD-2026-78661

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 36%
public exploits: 0; none known

Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.

Patch / fix

fixed in 2 distros 5 links 3

pypi tornado 6.5.8
tornadoweb tornado 6.5.8

ubuntu red hat suse opensuse almalinux

python-tornado Ubuntu 24.04 LTS 6.4.0-1ubuntu0.6
python-tornado Ubuntu 26.04 LTS 6.5.4-0.1ubuntu0.2
python-tornado Ubuntu Pro 16.04 LTS 4.2.1-1ubuntu3.1+esm4
python-tornado Ubuntu Pro 18.04 LTS 4.5.3-1ubuntu0.2+esm4
python-tornado Ubuntu Pro 22.04 LTS 6.1.0-3ubuntu0.1~esm6

ubuntu advisories UBUNTU-CVE-2026-91990

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

python-tornado RHEL 10.2 6.5.8-0.el10_2.1
python3-tornado RHEL 10.2 6.5.8-0.el10_2.1
python-tornado RHEL 9 6.5.8-0.el9_8.1
python3-tornado RHEL 9 6.5.8-0.el9_8.1
python-tornado enterprise linux eus 10.0 6.5.8-0.el10_0.1
python3-tornado enterprise linux eus 10.0 6.5.8-0.el10_0.1

red hat advisories RHSA-2026:80741 RHSA-2026:67147 RHSA-2026:67146

python-tornado6 SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.5-160000.7.1
python-tornado SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +11 more 4.5.3-150000.3.31.1
python-tornado6 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 6.3.2-150400.9.27.1

suse advisories SUSE-SU-2026:24121-1 SUSE-SU-2026:24207-1 SUSE-SU-2026:4404-1 SUSE-SU-2026:4403-1

python-tornado6 openSUSE Leap 16.0 6.5-160000.7.1

opensuse advisories openSUSE-SU-2026:22059-1

python3-tornado AlmaLinux 9 6.5.8-0.el9_8.1
python3-tornado AlmaLinux 10 6.5.8-0.el10_2.1

almalinux advisories ALSA-2026:67146 ALSA-2026:67147

github.com/tornadoweb/tornado@de85b3f commit
github.com/tornadoweb/tornado#3704 pull request
github.com/tornadoweb/tornado/releases/tag/v6.5.8 release

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-91990 updated 2026-11-05 cvss 7.5

tornado: Tornado: Denial of Service via memory amplification in multipart parsing

Red Hat Exploit Intelligence exploit-intelligence-tech-preview/vulnerability-analysis-rhel9
affected: workaround, no fix planned “Will not fix”
Red Hat Lightspeed Core lightspeed-core/rag-tool-cpu-rhel9, lightspeed-core/lightspeed-stack-rhel9, lightspeed-core/rag-tool-cuda-12.9-rhel9
affected: workaround, no fix available
Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-ocp-rag-rhel9
affected: workaround, no fix planned “Will not fix”
Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/lightspeed-chatbot-rhel9
affected: workaround, no fix available
Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat OpenShift AI (RHOAI) rhoai/odh-llama-stack-core-rhel9 Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-9, python-tornado 6.1.0-3.el9ocp.1 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9 Red Hat OpenStack Platform 16.2 rhosp-rhel8/openstack-redis, rhosp-rhel8/openstack-haproxy, rhosp-rhel8/openstack-mariadb, rhosp-rhel8/openstack-rabbitmq, rhosp-rhel8/openstack-ovn-northd, rhosp-rhel8/openstack-manila-share, +2 more Red Hat OpenStack Platform 17.1 rhosp-rhel9/openstack-redis, rhosp-rhel9/openstack-haproxy, rhosp-rhel9/openstack-mariadb, rhosp-rhel9/openstack-rabbitmq, rhosp-rhel9/openstack-ovn-northd, rhosp-rhel9/openstack-manila-share, +2 more
affected: workaround, no fix available
Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/lightspeed-chatbot-rhel9 1791250620
fixed: vendor fix RHSA-2026:79378
Red Hat Enterprise Linux AppStream (v. 9) python-tornado 6.5.8-0.el9_8.1, python3-tornado 6.5.8-0.el9_8.1
fixed: vendor fix RHSA-2026:67146

show 11 more

Red Hat Enterprise Linux AppStream (v. 10) python-tornado 6.5.8-0.el10_2.1, python3-tornado 6.5.8-0.el10_2.1
fixed: vendor fix RHSA-2026:67147
Red Hat Enterprise Linux AppStream EUS (v. 10.0) python-tornado 6.5.8-0.el10_0.1, python3-tornado 6.5.8-0.el10_0.1
fixed: vendor fix RHSA-2026:80741
Red Hat Enterprise Linux AppStream EUS (v.9.6) python-tornado 6.4.2-2.el9_6.7, python3-tornado 6.4.2-2.el9_6.7
fixed: vendor fix RHSA-2026:90283
Red Hat OpenShift AI 2.25 rhoai/odh-feature-server-rhel9 1792148523, rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 1791867208
fixed: vendor fix RHSA-2026:87410
Red Hat OpenShift AI 3.4 rhoai/odh-feature-server-rhel9 1791863220, rhoai/odh-th06-cpu-torch210-py312-rhel9 1793084640, rhoai/odh-th06-rocm64-torch291-py312-rhel9 1792745990, rhoai/odh-th06-cuda130-torch210-py312-rhel9 1792748650, rhoai/odh-trustyai-nemo-guardrails-server-rhel9 1791556128, rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9 1792688615, +17 more
fixed: vendor fix RHSA-2026:84734
Red Hat OpenShift AI 3.5 rhoai/odh-th-torch-cpu-py312-rhel9 1791926611, rhoai/odh-th-torch-cuda-py312-rhel9 1791927642, rhoai/odh-th-torch-rocm-py312-rhel9 1791925861, rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9 1791572004, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 1791816462, rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 1791951049, +15 more
fixed: vendor fix RHSA-2026:86891
Red Hat Migration Toolkit for Applications 8 mta/mta-solution-server-rhel9 Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1791254555, ansible-automation-platform-27/gateway-rhel9 1791257377, ansible-automation-platform-27/hub-web-rhel9 1791264503, ansible-automation-platform-27/receptor-rhel9 1791251288, ansible-automation-platform-27/mcp-tools-rhel9 1790931895, ansible-automation-platform-27/controller-rhel9 1791253059, +26 more
not affected: vulnerable code not present
Red Hat Enterprise Linux 8 pcs, pcs-snmp
not affected: inline mitigations already exist
Red Hat Enterprise Linux 9 rhel9/keylime-verifier, rhel9/keylime-registrar Red Hat Enterprise Linux 10 rhel10/keylime-verifier, rhel10/keylime-registrar
not affected: vulnerable code not present
Red Hat OpenShift AI (RHOAI) rhoai/odh-th06-cpu-torch291-py312-rhel9, rhoai/odh-th06-cuda130-torch291-py312-rhel9
not affected: component not present
Red Hat OpenShift AI 2.25 rhoai/odh-rhel9-operator 1792570619, rhoai/odh-vllm-cpu-rhel9 1792018436, rhoai/odh-dashboard-rhel9 1791853525, rhoai/odh-modelmesh-rhel9 1790881700, rhoai/odh-operator-bundle 1792571069, rhoai/odh-vllm-cuda-rhel9 1791358976, +64 more Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1791509689, rhoai/odh-cli-rhel9 1792722177, rhoai/rhai-cli-rhel9 1791509689, rhoai/rhai-cli-rhel9 1792722177, rhoai/odh-automl-rhel9 1791535789, rhoai/odh-automl-rhel9 1792697253, +183 more Red Hat OpenShift AI 3.5 rhoai/odh-cli-rhel9 1791945905, rhoai/rhai-cli-rhel9 1791945905, rhoai/odh-automl-rhel9 1791916705, rhoai/odh-mlflow-rhel9 1791947857, rhoai/odh-autorag-rhel9 1791903266, rhoai/odh-trainer-rhel9 1791952138, +92 more Red Hat OpenShift Container Platform 4 python-flit 3.9.0-3.1.el9ocp, python-pep517 0.13.0-5.2.el9ocp
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: partial
Assessed: 54 d ago (2026-09-15)

Exploit prediction

0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem	package	affected	fixed in
pypi	tornado	<6.5.8	6.5.8

Affected products

tornadoweb tornado

Classification

Weakness

CWE-770 Allocation of Resources Without Limits or Throttling

References

github.com /tornadoweb/tornado/pull/3704
web
github.com /tornadoweb/tornado/commit/de85b3f87446e323e881bbaa3d5a74f4b76e5f05
web
github.com /tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq
vendor-advisory, exploit, web
vulncheck.com /advisories/tornado-before-6.5.8-memory-amplification-dos-via-multipart
third-party-advisory
gist.github.com /afldl/649861f25d39b53b7edbe0298e171617
web
github.com /tornadoweb/tornado
package
github.com /tornadoweb/tornado/releases/tag/v6.5.8
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary