Threats tagged 'brew-snakeviz-ghsa-8423-8fgw-73vq'

CVE-2026-91990 is a high-severity denial-of-service vulnerability in the Tornado web framework affecting versions from 0 up to but not including 6.5.8. The vulnerability arises from the multipart form data parsing function, which creates a large transient list by splitting the entire request body before enforcing limits on the number of parts. This can lead to excessive memory consumption and a denial of service when processing specially crafted HTTP requests with many parts. The vulnerability is exploitable without authentication.