Threats Tagged 'ubuntu-cve-2026-91990'

Python Tornado versions before 6.5.8 have a memory amplification vulnerability in the parse_multipart_form_data function. This vulnerability occurs because multipart data is split before validating the maximum allowed parts, allowing attackers to send crafted multipart requests with many parts. This can cause large transient lists in memory, exhausting server resources and leading to denial of service.

CVE-2026-91990 is a high-severity denial-of-service vulnerability in the Tornado web framework affecting versions from 0 up to but not including 6.5.8. The vulnerability arises from the multipart form data parsing function, which creates a large transient list by splitting the entire request body before enforcing limits on the number of parts. This can lead to excessive memory consumption and a denial of service when processing specially crafted HTTP requests with many parts. The vulnerability is exploitable without authentication.