Threats tagged 'brew-jupyterlab-cve-2026-103261'

CVE-2026-103261 is a denial-of-service vulnerability in Tornado 6.5.8 where the HTTPServerRequest.__init__ method parses query strings without limiting the number of fields. This allows an attacker to send a GET request with thousands of query parameters, causing excessive CPU usage and stalling Tornado's single-threaded event loop. The flaw is due to missing a max_num_fields limit on query string parsing, unlike the POST body parsing which has a 1000-field cap. This leads to event-loop blocking and degraded response times for all clients sharing the same IOLoop. The issue is fixed in Tornado 4.6.4 by adding a 1000-field limit and proper error handling.