Source: python-tornado Version: 6.5.5-4 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for python-tornado. CVE-2026-82397[0]: | Tornado is a Python web framework and asynchronous networking | library. Prior to 6.5.8, Tornado parses application/x-www-form- | urlencoded request bodies with urllib.parse.parse_qs in | tornado/escape.py without passing max_num_fields. | RequestHandler._execute in tornado/web.py parses the body before | handler dispatch through HTTPServerRequest._parse_body and | parse_body_arguments in tornado/httputil.py, so an unauthenticated | request body containing millions of separator-delimited fields can | synchronously stall the single-threaded event loop and delay every | connection. The body is bounded only by max_buffer_size, which | defaults to 104857600 bytes. This issue is fixed in version 6.5.8. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-82397 https://www.cve.org/CVERecord?id=CVE-2026-82397 [1] https://github.com/tornadoweb/tornado/security/advisories/GHSA-mpf4-983q-p7j4 [2] https://github.com/tornadoweb/tornado/commit/8d6363ed7b69d5f0da806efe34d256627a2191de Please adjust the affected versions in the BTS as needed. Regards, Salvatore
