Threats tagged 'brew-snakeviz-ghsa-3hv7-mjh2-fv65'

CVE-2026-103261 is a resource exhaustion vulnerability in Tornado Web server versions prior to 6.5.9. The HTTPServerRequest.__init__ method parses query strings without limiting the number of fields, unlike the POST-body parsing path which enforces a 1000-field limit. An attacker can send a GET request with thousands of query parameters, causing excessive CPU usage and blocking Tornado's single-threaded event loop, resulting in denial of service. This vulnerability affects all Tornado servers and can degrade response times for all clients sharing the same IOLoop. The issue is fixed by adding a field-count limit to query string parsing, consistent with the POST-body limit.