In Tornado versions before 6.5.5, the multipart/form-data parser does not limit the number of parts beyond the max_body_size setting (default 100MB). Since parsing is done synchronously on the main thread, an attacker can cause a denial-of-service by sending multipart requests with many parts, causing high CPU usage and blocking the main thread. The vulnerability is addressed in Tornado 6.5.5 by adding appropriate limits to prevent excessive resource consumption during multipart parsing.

An attacker can cause a denial-of-service by sending multipart/form-data requests with a very large number of parts, leading to synchronous parsing overhead on the main thread and effectively blocking the server from processing legitimate requests. This can degrade service availability.

This vulnerability is fixed in Tornado version 6.5.5. Users should upgrade to version 6.5.5 or later to remediate this issue. No other mitigation is indicated by the vendor advisory.