Python tornado: Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the… (CVE-2026-91990)

The vulnerability in Python Tornado prior to version 6.5.8 involves the parse_multipart_form_data function, which processes multipart form data. The function splits multipart data into parts before checking the max_parts limit, enabling an attacker to craft multipart requests with excessive parts. This results in large transient memory allocations that can exhaust server memory and cause a denial of service condition. The CVSS 3.1 base score is 7.5, indicating a medium severity denial of service vulnerability with network attack vector, low attack complexity, no privileges or user interaction required, and no confidentiality or integrity impact.

An attacker can cause a denial of service by exhausting server memory through sending specially crafted multipart requests with many parts. This impacts availability but does not affect confidentiality or integrity.

A fix is available in Tornado version 6.5.8. Users should upgrade to version 6.5.8 or later to remediate this vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.