Threats Tagged 'ubuntu-cve-2026-103261'
View all threats tagged with 'ubuntu-cve-2026-103261'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ubuntu-cve-2026-103261'
Click on any threat for detailed analysis and mitigation recommendations
Python Tornado versions before 6.5.9 do not limit the number of query string fields in HTTPServerRequest.__init__. This allows remote attackers to send unauthenticated GET requests with thousands of query parameters, causing event-loop stalling and degrading response times for all clients sharing the same IOLoop. Join the discussion | GCVE Database | 10/01/2026, 11:17:00 UTC Added: 10/22/2026, 17:16:06 UTC |
0 CVE-2026-103261 is a resource exhaustion vulnerability in Tornado Web server versions prior to 6.5.9. The HTTPServerRequest.__init__ method parses query strings without limiting the number of fields, unlike the POST-body parsing path which enforces a 1000-field limit. An attacker can send a GET request with thousands of query parameters, causing excessive CPU usage and blocking Tornado's single-threaded event loop, resulting in denial of service. This vulnerability affects all Tornado servers and can degrade response times for all clients sharing the same IOLoop. The issue is fixed by adding a field-count limit to query string parsing, consistent with the POST-body limit. Join the discussion | CVE Database V5 | 10/01/2026, 11:17:00 UTC Added: 10/01/2026, 14:56:20 UTC |
Showing 1 to 2 of 2 results