[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-31958":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T11:19:25.255Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":86,"aliases":87,"duplicate_of":9,"upstream":91,"downstream":92,"duplicates":161,"related":162,"reserved_at":9,"published_at":180,"modified_at":181,"state":182,"summary":183,"references_raw":192,"kevs":228,"epss":229,"epss_history":232,"metrics":509,"affected":524},"CVE-2026-31958","Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-400","Uncontrolled Resource Consumption","The product does not properly control the allocation and maintenance of a limited resource.","weakness","Draft","Class","High",[20,24,82],{"id":21,"name":22,"techniques":23},"CAPEC-147","XML Ping of the Death",[],{"id":25,"name":26,"techniques":27},"CAPEC-227","Sustained Client Engagement",[28],{"id":29,"name":30,"tactics":31,"countermeasures":35},"T1499","Endpoint Denial of Service",[32],{"id":33,"name":34},"TA0105","Impact",[36,41,45,49,53,57,61,65,69,73,78],{"id":37,"name":38,"tactic":39},"D3-UGLPA","User Geolocation Logon Pattern Analysis",{"name":40},"Detect",{"id":42,"name":43,"tactic":44},"D3-PMAD","Protocol Metadata Anomaly Detection",{"name":40},{"id":46,"name":47,"tactic":48},"D3-CSPP","Client-server Payload Profiling",{"name":40},{"id":50,"name":51,"tactic":52},"D3-PHDURA","Per Host Download-Upload Ratio Analysis",{"name":40},{"id":54,"name":55,"tactic":56},"D3-NTSA","Network Traffic Signature Analysis",{"name":40},{"id":58,"name":59,"tactic":60},"D3-APCA","Application Protocol Command Analysis",{"name":40},{"id":62,"name":63,"tactic":64},"D3-NTCD","Network Traffic Community Deviation",{"name":40},{"id":66,"name":67,"tactic":68},"D3-RTSD","Remote Terminal Session Detection",{"name":40},{"id":70,"name":71,"tactic":72},"D3-ISVA","Inbound Session Volume Analysis",{"name":40},{"id":74,"name":75,"tactic":76},"D3-NTF","Network Traffic Filtering",{"name":77},"Isolate",{"id":79,"name":80,"tactic":81},"D3-ITF","Inbound Traffic Filtering",{"name":77},{"id":83,"name":84,"techniques":85},"CAPEC-492","Regular Expression Exponential Blowup",[],[],[88,89,90],"GHSA-qjxf-f2mg-c6mc","ECHO-5939-f806-1836","PYSEC-2026-140",[],[93,95,97,99,101,103,105,107,109,111,113,115,117,119,121,123,125,127,129,131,133,135,137,139,141,143,145,147,149,151,153,155,157,159],{"_key":94},"OPENSUSE-SU-2026:10374-1",{"_key":96},"OPENSUSE-SU-2026:10389-1",{"_key":98},"SUSE-SU-2026:20770-1",{"_key":100},"SUSE-SU-2026:20761-1",{"_key":102},"SUSE-SU-2026:20797-1",{"_key":104},"SUSE-SU-2026:1064-1",{"_key":106},"OPENSUSE-SU-2026:20406-1",{"_key":108},"SUSE-SU-2026:20919-1",{"_key":110},"SUSE-SU-2026:1171-1",{"_key":112},"SUSE-SU-2026:1519-1",{"_key":114},"SUSE-SU-2026:1520-1",{"_key":116},"SUSE-SU-2026:1521-1",{"_key":118},"SUSE-SU-2026:1523-1",{"_key":120},"SUSE-SU-2026:1525-1",{"_key":122},"USN-8198-1",{"_key":124},"USN-8198-2",{"_key":126},"UBUNTU-CVE-2026-31958",{"_key":128},"OPENSUSE-SU-2026:20918-1",{"_key":130},"DEBIAN-CVE-2026-31958",{"_key":132},"MGASA-2026-0216",{"_key":134},"RHSA-2026:11454",{"_key":136},"RHSA-2026:11493",{"_key":138},"RHSA-2026:11494",{"_key":140},"RHSA-2026:11495",{"_key":142},"RHSA-2026:13641",{"_key":144},"RHSA-2026:13670",{"_key":146},"RHSA-2026:19034",{"_key":148},"RHSA-2026:19189",{"_key":150},"RHSA-2026:20572",{"_key":152},"RHSA-2026:20573",{"_key":154},"RHSA-2026:20577",{"_key":156},"RHSA-2026:20810",{"_key":158},"RHSA-2026:24342",{"_key":160},"RHSA-2026:8093",[],[163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178],{"_key":94},{"_key":96},{"_key":98},{"_key":100},{"_key":102},{"_key":104},{"_key":106},{"_key":108},{"_key":110},{"_key":112},{"_key":114},{"_key":116},{"_key":118},{"_key":120},{"_key":128},{"_key":179},"CGA-3JMV-9445-5G47","2026-03-11T19:27:23.380Z","2026-04-01T14:32:33.146Z","Modified",{"cisa_kev":184,"cisa_ransomware":184,"cisa_vendor":9,"epss_severity":185,"epss_score":186,"severity":187,"severity_score":188,"severity_version":189,"severity_source":190,"severity_vector":191,"severity_status":182},false,"low",0.00375,"high",8.7,"v4.0","cve.org","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",[193,203,207,211,216,220,224],{"url":194,"sources":195,"tags":198},"https://github.com/tornadoweb/tornado/security/advisories/GHSA-qjxf-f2mg-c6mc",[190,196,197],"nvd","osv_pypi",[199,200,201,202],"X Refsource CONFIRM","WEB","Vendor Advisory","Advisory",{"url":204,"sources":205,"tags":206},"https://nvd.nist.gov/vuln/detail/CVE-2026-31958",[197],[202],{"url":208,"sources":209,"tags":210},"https://github.com/tornadoweb/tornado/commit/119a195e290c43ad2d63a2cf012c29d43d6ed839",[197],[200],{"url":212,"sources":213,"tags":214},"https://github.com/tornadoweb/tornado",[197],[215],"PACKAGE",{"url":217,"sources":218,"tags":219},"https://github.com/tornadoweb/tornado/releases/tag/v6.5.5",[197],[200],{"url":221,"sources":222,"tags":223},"https://lists.debian.org/debian-lts-announce/2026/04/msg00000.html",[190,196,197],[200],{"url":225,"sources":226,"tags":227},"https://github.com/pypa/advisory-database/tree/main/vulns/tornado/PYSEC-2026-140.yaml",[197],[200],[],{"date":230,"score":186,"percentile":231},"2026-07-05",0.29471,[233,237,240,243,246,249,253,256,259,262,266,269,272,275,278,281,284,287,290,293,296,299,303,306,309,312,315,318,321,324,327,330,334,337,340,343,346,349,352,355,358,361,364,367,370,373,376,379,382,385,388,391,394,397,400,404,407,410,413,416,419,422,425,428,431,434,437,440,444,447,450,453,456,459,462,465,468,471,474,477,480,483,486,489,492,494,497,500,503,506],{"date":234,"score":235,"percentile":236},"2026-03-12",0.00048,0.14806,{"date":238,"score":235,"percentile":239},"2026-03-13",0.14822,{"date":241,"score":235,"percentile":242},"2026-03-14",0.14825,{"date":244,"score":235,"percentile":245},"2026-03-15",0.14779,{"date":247,"score":235,"percentile":248},"2026-03-16",0.14734,{"date":250,"score":251,"percentile":252},"2026-03-17",0.00071,0.21543,{"date":254,"score":251,"percentile":255},"2026-03-18",0.21536,{"date":257,"score":251,"percentile":258},"2026-03-19",0.2154,{"date":260,"score":251,"percentile":261},"2026-03-20",0.21587,{"date":263,"score":264,"percentile":265},"2026-03-21",0.00023,0.061,{"date":267,"score":264,"percentile":268},"2026-03-22",0.0609,{"date":270,"score":264,"percentile":271},"2026-03-23",0.06074,{"date":273,"score":264,"percentile":274},"2026-03-24",0.06056,{"date":276,"score":264,"percentile":277},"2026-03-25",0.06112,{"date":279,"score":264,"percentile":280},"2026-03-26",0.06161,{"date":282,"score":264,"percentile":283},"2026-03-27",0.06155,{"date":285,"score":264,"percentile":286},"2026-03-28",0.06164,{"date":288,"score":264,"percentile":289},"2026-03-29",0.06153,{"date":291,"score":264,"percentile":292},"2026-03-30",0.06136,{"date":294,"score":264,"percentile":295},"2026-03-31",0.06108,{"date":297,"score":264,"percentile":298},"2026-04-01",0.0611,{"date":300,"score":301,"percentile":302},"2026-04-02",0.0003,0.08419,{"date":304,"score":301,"percentile":305},"2026-04-03",0.08443,{"date":307,"score":301,"percentile":308},"2026-04-04",0.08472,{"date":310,"score":301,"percentile":311},"2026-04-05",0.08458,{"date":313,"score":301,"percentile":314},"2026-04-06",0.08383,{"date":316,"score":301,"percentile":317},"2026-04-07",0.08392,{"date":319,"score":301,"percentile":320},"2026-04-08",0.08464,{"date":322,"score":301,"percentile":323},"2026-04-09",0.08482,{"date":325,"score":301,"percentile":326},"2026-04-10",0.0848,{"date":328,"score":301,"percentile":329},"2026-04-11",0.08476,{"date":331,"score":332,"percentile":333},"2026-04-12",0.00032,0.09304,{"date":335,"score":332,"percentile":336},"2026-04-13",0.0929,{"date":338,"score":332,"percentile":339},"2026-04-14",0.09162,{"date":341,"score":332,"percentile":342},"2026-04-15",0.09179,{"date":344,"score":332,"percentile":345},"2026-04-16",0.09182,{"date":347,"score":332,"percentile":348},"2026-04-17",0.09178,{"date":350,"score":332,"percentile":351},"2026-04-18",0.09181,{"date":353,"score":332,"percentile":354},"2026-04-19",0.09152,{"date":356,"score":332,"percentile":357},"2026-04-20",0.09138,{"date":359,"score":332,"percentile":360},"2026-04-21",0.09332,{"date":362,"score":332,"percentile":363},"2026-04-22",0.09367,{"date":365,"score":332,"percentile":366},"2026-04-23",0.09389,{"date":368,"score":332,"percentile":369},"2026-04-24",0.09383,{"date":371,"score":332,"percentile":372},"2026-04-25",0.09368,{"date":374,"score":332,"percentile":375},"2026-04-26",0.09337,{"date":377,"score":332,"percentile":378},"2026-04-27",0.09318,{"date":380,"score":332,"percentile":381},"2026-04-28",0.09298,{"date":383,"score":332,"percentile":384},"2026-04-29",0.09299,{"date":386,"score":332,"percentile":387},"2026-04-30",0.09296,{"date":389,"score":332,"percentile":390},"2026-05-01",0.09249,{"date":392,"score":332,"percentile":393},"2026-05-02",0.09292,{"date":395,"score":332,"percentile":396},"2026-05-03",0.09267,{"date":398,"score":332,"percentile":399},"2026-05-04",0.09223,{"date":401,"score":402,"percentile":403},"2026-05-05",0.00027,0.07483,{"date":405,"score":402,"percentile":406},"2026-05-06",0.07507,{"date":408,"score":402,"percentile":409},"2026-05-07",0.07628,{"date":411,"score":402,"percentile":412},"2026-05-08",0.07648,{"date":414,"score":402,"percentile":415},"2026-05-09",0.07698,{"date":417,"score":402,"percentile":418},"2026-05-10",0.07708,{"date":420,"score":402,"percentile":421},"2026-05-11",0.07692,{"date":423,"score":402,"percentile":424},"2026-05-12",0.07714,{"date":426,"score":402,"percentile":427},"2026-05-13",0.07719,{"date":429,"score":402,"percentile":430},"2026-05-14",0.07757,{"date":432,"score":402,"percentile":433},"2026-05-15",0.07761,{"date":435,"score":402,"percentile":436},"2026-05-16",0.07779,{"date":438,"score":402,"percentile":439},"2026-05-17",0.07773,{"date":441,"score":442,"percentile":443},"2026-05-18",0.00028,0.08094,{"date":445,"score":442,"percentile":446},"2026-05-19",0.08072,{"date":448,"score":442,"percentile":449},"2026-05-20",0.08068,{"date":451,"score":442,"percentile":452},"2026-05-21",0.08051,{"date":454,"score":442,"percentile":455},"2026-05-22",0.08343,{"date":457,"score":442,"percentile":458},"2026-05-23",0.08333,{"date":460,"score":442,"percentile":461},"2026-05-24",0.0833,{"date":463,"score":442,"percentile":464},"2026-05-25",0.08323,{"date":466,"score":442,"percentile":467},"2026-05-26",0.08318,{"date":469,"score":442,"percentile":470},"2026-05-27",0.08363,{"date":472,"score":442,"percentile":473},"2026-05-28",0.08513,{"date":475,"score":442,"percentile":476},"2026-05-29",0.08534,{"date":478,"score":442,"percentile":479},"2026-05-30",0.08537,{"date":481,"score":442,"percentile":482},"2026-05-31",0.08517,{"date":484,"score":442,"percentile":485},"2026-06-01",0.0849,{"date":487,"score":442,"percentile":488},"2026-06-02",0.08444,{"date":490,"score":442,"percentile":491},"2026-06-03",0.08404,{"date":493,"score":442,"percentile":302},"2026-06-04",{"date":495,"score":442,"percentile":496},"2026-06-05",0.08453,{"date":498,"score":442,"percentile":499},"2026-06-06",0.08471,{"date":501,"score":442,"percentile":502},"2026-06-07",0.08451,{"date":504,"score":442,"percentile":505},"2026-06-08",0.08394,{"date":507,"score":442,"percentile":508},"2026-06-09",0.08427,[510,513,521],{"source":190,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":511},{"baseScore":188,"baseSeverity":512,"vectorString":191,"impactScore":9,"exploitabilityScore":9},"HIGH",{"source":196,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":514,"cvss_v4_0":519},{"baseScore":515,"baseSeverity":512,"vectorString":516,"impactScore":517,"exploitabilityScore":518},7.5,"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",6,10,{"baseScore":188,"baseSeverity":512,"vectorString":520,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",{"source":197,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":522,"cvss_v4_0":523},{"baseScore":515,"baseSeverity":9,"vectorString":516,"impactScore":517,"exploitabilityScore":518},{"baseScore":188,"baseSeverity":9,"vectorString":191,"impactScore":9,"exploitabilityScore":9},[525,536],{"ecosystem":526,"name":527,"vendor":526,"product":527,"cpe_part":9,"purl_type":528,"purl_namespace":9,"purl_name":527,"source":9,"versions":529},"PyPI","tornado","pypi",[530],{"version":531,"is_range":532,"range_type":533,"version_start":9,"version_start_type":9,"version_end":534,"version_end_type":535,"fixed_in":9},"lt6_5_5",true,"ecosystem","6.5.5","excluding",{"ecosystem":9,"name":527,"vendor":537,"product":527,"cpe_part":538,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":539},"tornadoweb","a",[540],{"version":541,"is_range":532,"range_type":542,"version_start":9,"version_start_type":9,"version_end":534,"version_end_type":535,"fixed_in":9},"lt6.5.5","cpe"]