CVE-2026-103261

MEDIUM 5.3

Tornado before 6.5.9 Denial of Service via Query String

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts to degrade response times for all clients sharing the same IOLoop.

CWE	CWE-770
Vendor	tornadoweb
Product	tornado
Published	Oct 1, 2026

Stay Ahead of the Next One

Get instant alerts for tornadoweb tornado

Be the first to know when new medium vulnerabilities affecting tornadoweb tornado are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

tornadoweb / tornado

0 < 6.5.9

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/tornadoweb/tornado/security/advisories/GHSA-3hv7-mjh2-fv65 github.com: https://github.com/tornadoweb/tornado/commit/03945136ea9746eccf61caf88edae39642e59c93 vulncheck.com: https://www.vulncheck.com/advisories/tornado-before-6.5.9-denial-of-service-via-query-string

Credits

🔍 iaohkut-from-NightWolf-Team 🔍 manus-pi