{"vulnerability": "GHSA-8423-8fgw-73vq", "sightings": [{"uuid": "cb1c5bbd-269d-4084-8e96-3c455e40af7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-8423-8FGW-73VQ", "type": "seen", "source": "https://gist.github.com/alon710/6ddd193ef693b085524dc4da97851f2c", "content": "# GHSA-8423-8FGW-73VQ: GHSA-8423-8FGW-73VQ: Memory Amplification Denial of Service in Tornado Multipart Form Parser\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/GHSA-8423-8FGW-73VQ\n\n## Summary\nGHSA-8423-8FGW-73VQ is a pre-authentication denial of service vulnerability in the Tornado web server's handling of multipart/form-data. The flaw allows an unauthenticated remote attacker to cause memory exhaustion and CPU starvation by transmitting a crafted HTTP request containing a high density of boundary delimiters. Because Tornado splits the entire request body in memory prior to enforcing the max_parts validation threshold, the Python interpreter attempts to materialize a massive list of byte segments. This triggers an immediate memory exhaustion (OOM) crash or server-wide CPU starvation before the payload can be validated and rejected.\n\n## TL;DR\nUnauthenticated remote Denial of Service in Tornado's multipart parser due to memory and CPU amplification occurring before verification of max_parts limits, leading to Out-of-Memory crashes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network\n- **CVSS Score**: 5.3\n- **EPSS Score**: Not Available\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Tornado Web Server\n- **tornado**: < 6.5.8 (Fixed in: `6.5.8`)\n\n## Mitigation\n\n- Upgrade Tornado to version 6.5.8 or higher.\n- Implement client body size limits on reverse proxies and load balancers.\n- Deploy WAF rules to reject multipart/form-data requests with boundary strings shorter than 8 characters.\n\n**Remediation Steps:**\n1. Audit Python dependencies across all application deployments to identify Tornado versions below 6.5.8.\n2. Update requirements.txt, Pipfile, or poetry.lock to specify tornado>=6.5.8.\n3. Rebuild and redeploy application containers with the updated dependencies.\n4. Configure front-end proxy limits (e.g., Nginx client_max_body_size) to restrict incoming request body sizes.\n\n## References\n\n- [GHSA-8423-8fgw-73vq Security Advisory](https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq)\n- [Tornado Fix Commit](https://github.com/tornadoweb/tornado/commit/de85b3f87446e323e881bbaa3d5a74f4b76e5f05)\n- [Tornado Release v6.5.8](https://github.com/tornadoweb/tornado/releases/tag/v6.5.8)\n- [Exploit Proof of Concept Gist](https://gist.github.com/afldl/649861f25d39b53b7edbe0298e171617)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-8423-8FGW-73VQ) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T14:12:39.856716Z"}]}