Tornado versions prior to 6.5.8 contain a vulnerability in the multipart form data parsing logic. Specifically, the parse_multipart_form_data function processes multipart data by splitting it into parts before validating the maximum allowed number of parts (max_parts). An attacker can exploit this by crafting multipart requests with an excessive number of parts, resulting in large transient lists that consume excessive memory. This resource exhaustion can cause the server to become unresponsive, resulting in a denial of service condition.

Successful exploitation leads to denial of service by exhausting server memory through crafted multipart requests with many parts. This can disrupt availability of applications using affected Tornado versions.

Upgrade Tornado to version 6.5.8 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed by the version range indicating the fix in 6.5.8.