Threats tagged 'brew-jupyterlab-cve-2026-82397'

Tornado's parsing of application/x-www-form-urlencoded request bodies does not limit the number of fields parsed, allowing a specially crafted request with many separators to create tens of millions of fields. This parsing occurs synchronously on the single-threaded event loop before request handling, causing the entire server to stall and resulting in a denial of service. No authentication is required to trigger this condition if any route accepts form posts. The issue affects Tornado versions from 1.2.0 up to but not including 4.6.3 and is fixed in version 4.6.3.