8.7

CVE-2026-31958: Tornado has a DoS due to too many multipart parts

Modified
AliasesSUSE-SU-2026:1064-1SUSE-SU-2026:1171-1SUSE-SU-2026:1519-1
Published 11-03-2026Last modified 01-04-2026

Vulnerability summary

CVE-2026-31958 is a high (CVSS 8.7) Uncontrolled Resource Consumption vulnerability in tornadoweb tornado. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 33.1% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 8.7 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
8.7/10
010
High · v4.0 (CVE.org)
EPSS score
0.39%
0%100%
Low · -0.10 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 16 · Related 5
MGASA-2026-0216OPENSUSE-SU-2026:10389-1RHSA-2026:11454RHSA-2026:11493RHSA-2026:11494RHSA-2026:11495

Timeline

  1. 11-03-2026
    PublishedVulnerability first disclosed.
  2. 01-04-2026
    Last modifiedVulnerability information updated.

Description

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.

CVSS metrics

10 scores · 8 sources · 2 versions

EPSS trend

Probability

0.39%

Chance of exploitation in the next 30 days

Percentile

33%

Versus all other CVEs

30-day change

Decrease -0.10 pp

From 0.49% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse74 products
  • golang-github-lusitaniae-apache_exporter&distro=SUSE Multi Linux Manager Tools EL-8< 1.0.10-80002.3.6.2
  • golang-github-lusitaniae-apache_exporter&distro=SUSE Multi Linux Manager Tools EL-9< 1.0.10-90002.3.6.1
  • golang-github-lusitaniae-apache_exporter&distro=SUSE Multi Linux Manager Tools RES-7< 1.0.10-70002.3.6.1
  • golang-github-lusitaniae-apache_exporter&distro=SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update< 1.0.10-90002.3.6.1
  • golang-github-lusitaniae-apache_exporter&distro=SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update< 1.0.10-70002.3.6.1
Chainguard8 products
  • airflow-2< 2.11.2-r1
  • airflow-3< 3.1.8-r2
  • dask-kubernetes< 2026.3.0-r1
  • kubeflow-pipelines-visualization-server< 2.16.0-r2
  • litellm< 1.81.14-r1
Opensuse5 products
  • python-tornado6&distro=openSUSE Leap 15.6< 6.3.2-150400.9.15.1
  • python-tornado6&distro=openSUSE Leap 16.0< 6.5-160000.4.1
  • python-tornado6&distro=openSUSE Tumbleweed< 6.5.5-1.1
  • salt-test&distro=openSUSE Leap 16.0< 3006.0-160000.5.1
  • salt&distro=openSUSE Leap 16.0< 3006.0-160000.5.1
Wolfi4 products
  • airflow-3< 3.1.8-r2
  • dask-kubernetes< 2026.3.0-r1
  • kubeflow-pipelines-visualization-server< 2.16.0-r2
  • mitmproxy< 12.2.2-r1
Redhat2 products
  • pcs< 0:0.10.18-2.el8_10.9
  • pcs-snmp< 0:0.10.18-2.el8_10.9
Debian1 product
  • python-tornadoAll versions (No fix recorded) | < 6.5.5-1
PyPI1 product
  • tornado< 6.5.5
Tornadoweb1 product
Ubuntu1 product
  • python-tornado< 4.2.1-1ubuntu3.1+esm3 | < 4.5.3-1ubuntu0.2+esm3 | < 6.1.0-3ubuntu0.1~esm5 | < 6.4.0-1ubuntu0.5 | < 6.4.2-3ubuntu0.3 | < 6.5.4-0.1ubuntu0.1

9 vendors · 97 products

References

52 links
Show all 52 references