DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

GHSA-8423-8FGW-73VQ: GHSA-8423-8FGW-73VQ: Memory Amplification Denial of Service in Tornado Multipart Form Parser

#security #cve #cybersecurity #ghsa

GHSA-8423-8FGW-73VQ: Memory Amplification Denial of Service in Tornado Multipart Form Parser

Vulnerability ID: GHSA-8423-8FGW-73VQ
CVSS Score: 5.3
Published: 2026-09-01

GHSA-8423-8FGW-73VQ is a pre-authentication denial of service vulnerability in the Tornado web server's handling of multipart/form-data. The flaw allows an unauthenticated remote attacker to cause memory exhaustion and CPU starvation by transmitting a crafted HTTP request containing a high density of boundary delimiters. Because Tornado splits the entire request body in memory prior to enforcing the max_parts validation threshold, the Python interpreter attempts to materialize a massive list of byte segments. This triggers an immediate memory exhaustion (OOM) crash or server-wide CPU starvation before the payload can be validated and rejected.

TL;DR

Unauthenticated remote Denial of Service in Tornado's multipart parser due to memory and CPU amplification occurring before verification of max_parts limits, leading to Out-of-Memory crashes.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-400
  • Attack Vector: Network
  • CVSS Score: 5.3
  • EPSS Score: Not Available
  • Impact: Denial of Service (DoS)
  • Exploit Status: PoC Available
  • KEV Status: Not Listed

Affected Systems

  • Tornado Web Server
  • tornado: < 6.5.8 (Fixed in: 6.5.8)

Code Analysis

Commit: de85b3f

httputil: Apply multipart max_parts limit earlier. This prevents some CPU and memory amplification attacks.

@@ -1078,7 +1078,9 @@
-    parts = data[:final_boundary_index].split(b"--" + boundary + b"\r\n")
+    parts = data[:final_boundary_index].split(
+        b"--" + boundary + b"\r\n", config.max_parts + 1
+    )
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • GitHub Gist: Proof of Concept script demonstrating memory amplification via the split-before-count vulnerability in Tornado's httputil parser.

Mitigation Strategies

  • Upgrade Tornado to version 6.5.8 or higher.
  • Implement client body size limits on reverse proxies and load balancers.
  • Deploy WAF rules to reject multipart/form-data requests with boundary strings shorter than 8 characters.

Remediation Steps:

  1. Audit Python dependencies across all application deployments to identify Tornado versions below 6.5.8.
  2. Update requirements.txt, Pipfile, or poetry.lock to specify tornado>=6.5.8.
  3. Rebuild and redeploy application containers with the updated dependencies.
  4. Configure front-end proxy limits (e.g., Nginx client_max_body_size) to restrict incoming request body sizes.

References

Read the full report for GHSA-8423-8FGW-73VQ on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)