Threats Tagged 'cve-2026-82397'

## Summary When SimpleAsyncHTTPClient follows a 3xx redirect, it shallow-copies the original HTTPRequest, rewrites the URL, decrements max_redirects, and removes only the Host header. It does not clear Authorization, auth_username, auth_password, or auth_mode when the redirect target changes origin. As a result, credentials intended for one origin can be forwarded to a different origin when follow_redirects=True, which is the default. Beginning in Tornado 6.5.6, `SimpleAsyncHTTPClient` matches the default behavior of `libcurl` (and therefore `CurlAsyncHTTPClient`): When a redirect changes the scheme, host, or port of the url, the `Authorization` and `Cookie` headers will be removed when following the redirect.

CVE-2026-82397 is a denial of service vulnerability in Tornado web framework versions prior to 6.5.8. It arises because Tornado parses application/x-www-form-urlencoded request bodies using urllib.parse.parse_qs without limiting the maximum number of fields. An attacker can send a large request body composed mostly of separators, causing the parser to generate tens of millions of fields synchronously on the event loop, stalling the entire server process. This vulnerability requires no authentication and affects any route accepting form posts.