BREW-jupyterlab-GHSA-8423-8fgw-73vq — tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

2026-09-29T16:45:23.386486+00:00

Affected: Homebrew: jupyterlab

## Description

### Summary

`parse_multipart_form_data` (httputil.py:34) calls `data.split(b"--"+boundary+b"\r\n")` **before** the `max_parts` check (:35). A 600KB body with 100k parts creates a 100k-element transient list first, then rejects transient memory amplification (each split element is a copy). Pre-auth HTTP DoS.

### Root cause

```python parts = data[:final_boundary_index].split(b"--" + boundary + b"\r\n") # :34 huge list first if len(parts) > config.max_parts: # :35 check after raise HTTPInputError("multipart/form-data has too many parts") ```

### PoC

gist: https://gist.github.com/afldl/649861f25d39b53b7edbe0298e171617 `poc.py` + `output.txt` (100k parts from 600KB transient list).

### Fix

Count separators without materializing the list (e.g. `data.count(b"--"+boundary)` first).

### Credit

Reported by afldl, 2026-07.

CLEANSTART-2026-NE81748 — Security fix for ghsa-8423-8fgw-73vq applied in: airflow-3 3.0.6-r8, airflow-3 3.2.2-r7, airflow-3 3.1.8-r11

2026-09-29T16:45:23.386661+00:00

Affected: CleanStart: airflow-3

ghsa-8423-8fgw-73vq affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

Most recent entries from all

BREW-jupyterlab-GHSA-8423-8fgw-73vq — tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

CLEANSTART-2026-NE81748 — Security fix for ghsa-8423-8fgw-73vq applied in: airflow-3 3.0.6-r8, airflow-3 3.2.2-r7, airflow-3 3.1.8-r11