{"schema":"threatline.record/2","record":{"id":"CVE-2026-103261","aliases":["GHSA-3hv7-mjh2-fv65"],"summary":"Tornado before 6.5.9 Denial of Service via Query String","details":"Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts to degrade response times for all clients sharing the same IOLoop.","categories":["Libraries & packages"],"product":"tornado","vendor":"tornadoweb","ecosystem":"PyPI","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103261","source_modified_at":"2026-10-01T14:44:26.683Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"tornado","vendor":"tornadoweb","versions":[{"version":"0","status":"affected","versionType":"semver","lessThan":"6.5.9"},{"version":"6.5.9","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-3hv7-mjh2-fv65","source_modified_at":"2026-10-02T03:56:09.601689224Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"ecosystem":"PyPI","name":"tornado","purl":"pkg:pypi/tornado"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"6.5.9"}],"type":"ECOSYSTEM"}],"versions":["0.2","1.0","1.1","1.1.1","1.2","1.2.1","2.0","2.1","2.1.1","2.2","2.2.1","2.3","2.4","2.4.1","3.0","3.0.1","3.0.2","3.1","3.1.1","3.2","3.2.1","3.2.2","4.0","4.0.1","4.0.2","4.1","4.1b2","4.2","4.2.1","4.2b1","4.3","4.3b1","4.3b2","4.4","4.4.1","4.4.2","4.4.3","4.4b1","4.5","4.5.1","4.5.2","4.5.3","4.5b1","4.5b2","5.0","5.0.1","5.0.2","5.0a1","5.0b1","5.1"]}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103261","source_modified_at":"2026-10-01T14:44:26.683Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"tornado","ecosystem":null},"version":"6.5.9","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-3hv7-mjh2-fv65","source_modified_at":"2026-10-02T03:56:09.601689224Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"ecosystem":"PyPI","name":"tornado","purl":"pkg:pypi/tornado"},"version":"6.5.9"}],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00467,"percentile":0.39504,"score_date":"2026-10-23"},"published_at":"2026-10-01T10:42:04.230Z","modified_at":"2026-10-02T03:56:09.601689224Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-103261","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-01T14:44:26.683Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-3hv7-mjh2-fv65","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-02T03:56:09.601689224Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-103261","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-3hv7-mjh2-fv65","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://github.com/tornadoweb/tornado/commit/03945136ea9746eccf61caf88edae39642e59c93","tags":["patch"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/tornado-before-6.5.9-denial-of-service-via-query-string","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-01T14:44:15.608259Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-02T03:56:09.601689224Z","content_hash":"77bc24d479aa171deb1b26c316da0285725eaeeb6bf67395d58fd91b27eb18a4"}}