All vulnerabilities
CVE-2026-103261GHSA-3hv7-mjh2-fv65

Tornado before 6.5.9 Denial of Service via Query String

tornadoweb tornadoPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.47%Chance of exploitation activity in the next 30 days, higher than 39% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.5.9Fixed versionCVE List
Published1 Oct 2026Updated 2 Oct 2026CVE List

What fixes it

  • 6.5.9tornadoCVE List
  • 6.5.9tornado, PyPIOSVpip install "tornado>=6.5.9"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts to degrade response times for all clients sharing the same IOLoop.

Text from CVE List

Affected versions 53

  • tornadoaffected: all versions before 6.5.9CVE List
  • tornadounaffected: 6.5.9CVE List
  • tornado, PyPIfrom first release, fixed in 6.5.9OSV
  • tornado, PyPI0.2OSV
  • tornado, PyPI1.0OSV
  • tornado, PyPI1.1OSV
  • tornado, PyPI1.1.1OSV
  • tornado, PyPI1.2OSV
  • tornado, PyPI1.2.1OSV
  • tornado, PyPI2.0OSV
  • tornado, PyPI2.1OSV
  • tornado, PyPI2.1.1OSV
  • tornado, PyPI2.2OSV
  • tornado, PyPI2.2.1OSV
  • tornado, PyPI2.3OSV
  • tornado, PyPI2.4OSV
  • tornado, PyPI2.4.1OSV
  • tornado, PyPI3.0OSV
  • tornado, PyPI3.0.1OSV
  • tornado, PyPI3.0.2OSV
  • tornado, PyPI3.1OSV
  • tornado, PyPI3.1.1OSV
  • tornado, PyPI3.2OSV
  • tornado, PyPI3.2.1OSV
  • tornado, PyPI3.2.2OSV
  • tornado, PyPI4.0OSV
  • tornado, PyPI4.0.1OSV
  • tornado, PyPI4.0.2OSV
  • tornado, PyPI4.1OSV
  • tornado, PyPI4.1b2OSV
  • tornado, PyPI4.2OSV
  • tornado, PyPI4.2.1OSV
  • tornado, PyPI4.2b1OSV
  • tornado, PyPI4.3OSV
  • tornado, PyPI4.3b1OSV
  • tornado, PyPI4.3b2OSV
  • tornado, PyPI4.4OSV
  • tornado, PyPI4.4.1OSV
  • tornado, PyPI4.4.2OSV
  • tornado, PyPI4.4.3OSV
  • tornado, PyPI4.4b1OSV
  • tornado, PyPI4.5OSV
  • tornado, PyPI4.5.1OSV
  • tornado, PyPI4.5.2OSV
  • tornado, PyPI4.5.3OSV
  • tornado, PyPI4.5b1OSV
  • tornado, PyPI4.5b2OSV
  • tornado, PyPI5.0OSV
  • tornado, PyPI5.0.1OSV
  • tornado, PyPI5.0.2OSV
  • tornado, PyPI5.0a1OSV
  • tornado, PyPI5.0b1OSV
  • tornado, PyPI5.1OSV

References 3