CVE-2026-31958: Tornadoweb Tornado

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.

Affected products

• Tornadoweb Tornado: before 6.5.5 (fixed in 6.5.5)

Published 2026-03-11. Last modified 2026-06-17.