CVE-2026-82397: CWE-400: Uncontrolled Resource Consumption in tornadoweb tornado

Tornado's request body parsing for application/x-www-form-urlencoded data uses urllib.parse.parse_qs without specifying the max_num_fields parameter, which was introduced in CPython to prevent excessive resource consumption. Because Tornado parses the body synchronously on the single-threaded event loop before dispatching to handlers, a crafted request with a large number of separators can cause the parser to generate tens of millions of fields, exhausting CPU resources and causing a denial of service affecting the entire server process. The default maximum request body size is 100 MB, which can contain around fifty million fields if composed mostly of separators. The vulnerability is present in Tornado versions before 6.5.8. The suggested fix is to pass a conservative max_num_fields limit to parse_qs and allow applications to raise it as needed. This would cause CPython to raise a ValueError when the limit is exceeded, which Tornado can map to a 400 Bad Request response.

This vulnerability allows unauthenticated attackers to cause a denial of service against the entire Tornado server process by sending a single large, specially crafted form-urlencoded request. Because Tornado is single-threaded and the parsing occurs synchronously on the event loop, all other connections are stalled until parsing completes. This can disrupt availability of all services running on the Tornado server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The suggested fix is to modify Tornado to pass the max_num_fields parameter to urllib.parse.parse_qs with a conservative default limit, causing excessive requests to be rejected with a 400 error. Additionally, lowering the maximum allowed request body size specifically for urlencoded content would help mitigate the risk. Until a patch is available, consider implementing application-level request size limits and monitoring for unusually large form submissions.