CVE-2026-82397: 
Python vulnerability analysis and mitigation

CVE-2026-82397 is a Denial of Service vulnerability in the Tornado Python web framework caused by unbounded application/x-www-form-urlencoded request body parsing. All versions up to and including 6.5.7 are affected; the issue is fixed in version 6.5.8. The vulnerability was reported by security researcher Arpit Jain (arpitjain099), disclosed via GitHub Security Advisory GHSA-mpf4-983q-p7j4 on August 7, 2026, and published to the NVD on August 31, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is Uncontrolled Resource Consumption (CWE-400) combined with Improper Validation of Specified Quantity in Input (CWE-1284). Tornado's parse_qs_bytes function in tornado/escape.py calls Python's urllib.parse.parse_qs without passing the max_num_fields parameter — a CPython argument specifically designed to limit field count during query string parsing. Because RequestHandler._execute in tornado/web.py parses the request body synchronously on the event loop before dispatching to any handler (via HTTPServerRequest._parse_body → parse_body_arguments → parse_qs_bytes), an attacker can send a single crafted POST request with a body composed almost entirely of & separators. The body size is bounded only by max_buffer_size, which defaults to 104,857,600 bytes (100 MB), allowing approximately 50 million fields to be generated and parsed synchronously, stalling the entire single-threaded event loop (GitHub Advisory, Tornado PR #3704).

Successful exploitation causes a process-wide Denial of Service: because Tornado is single-threaded and the parse is synchronous on the event loop, a single malicious request blocks all other concurrent connections for the duration of the parse. No confidentiality or integrity impact exists — the attack exclusively targets availability. Any Tornado application that accepts application/x-www-form-urlencoded POST bodies (the common default) is vulnerable without requiring authentication, making the attack surface broad (GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The attack is fully automatable (no user interaction or authentication required), and the EPSS score is approximately 0.35% (28th percentile), indicating a relatively low near-term exploitation probability. The CVE status is listed as "Deferred" and is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Identify target: Locate internet-facing services running Tornado versions <= 6.5.7 that expose any route accepting HTTP POST requests with Content-Type: application/x-www-form-urlencoded.
2. Craft malicious body: Construct a POST request body consisting almost entirely of & separator characters, up to the server's max_buffer_size limit (default 100 MB). For example: python -c "print('&' * 50000000, end='')" > payload.bin
3. Send the request: Transmit the crafted POST request to any form-accepting endpoint on the target server, e.g., curl -X POST -H 'Content-Type: application/x-www-form-urlencoded' --data-binary @payload.bin http://target/any-form-endpoint
4. Event loop stall: The server's synchronous parse_qs call processes tens of millions of fields on the event loop thread, blocking all other connections for the duration of the parse and rendering the application unresponsive.
5. Sustain DoS: Repeat requests as needed to maintain the denial of service condition, since each request independently triggers the expensive parse (GitHub Advisory, Tornado PR #3704).

• Network: Unusually large HTTP POST requests (approaching 100 MB) with Content-Type: application/x-www-form-urlencoded sent to any application endpoint; high-volume repeated POST requests from a single source IP.
• Logs: Web server or application access logs showing POST requests with very large Content-Length values (e.g., tens of megabytes) to form-accepting endpoints; Tornado error logs showing HTTPInputError: Invalid x-www-form-urlencoded body: Max number of fields exceeded (on patched versions) or prolonged request processing times.
• Process: Tornado worker process consuming sustained high CPU with no corresponding increase in successful responses; event loop latency metrics spiking during or after large POST requests; application health checks timing out or failing during the attack window.

Upgrade Tornado to version 6.5.8 or later, which enforces a default limit of 1,000 arguments for application/x-www-form-urlencoded request bodies — matching the defaults used by PHP and Node.js. The fix introduces a ParseUrlEncodedConfig class with a configurable max_arguments field accessible via set_parse_body_config() for applications that legitimately require more fields. As an interim workaround, reduce max_buffer_size from its 100 MB default to a value appropriate for your application to limit the maximum exploitable body size. SUSE Linux has also issued a security update (SUSE-SU-2026:4076-1) for affected distributions (Tornado Release v6.5.8, GitHub Advisory, SUSE Advisory).

The vulnerability was reported by researcher Arpit Jain (arpitjain099) and acknowledged by Tornado maintainer bdarnell, who merged the fix in PR #3704 on August 7, 2026. SUSE issued a security update for its Linux distributions, and the issue was tracked by the NixOS security team. Coverage appeared in German Linux security outlet pro-linux.de and was picked up by AUSCERT and INCIBE-CERT. The fix was also referenced in the VulcanBench defensive cybersecurity evaluation suite, indicating some community interest in using it as a test case (Tornado PR #3704, SUSE Advisory).