Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.

CVE-2026-82397 affects the Tornado Python web framework and asynchronous networking library in versions prior to 6.5.8. The vulnerability exists in the parsing of application/x-www-form-urlencoded request bodies using urllib.parse.parse_qs without enforcing a max_num_fields limit. An unauthenticated attacker can send a crafted request body containing millions of separator-delimited fields, causing the single-threaded event loop to stall synchronously and delaying all active connections. The body size is only bounded by max_buffer_size, which defaults to approximately 100MB, making large payloads feasible. The vulnerable code path runs before handler dispatch, meaning no authentication is required to trigger the issue. The fix was introduced in Tornado version 6.5.8, which enforces field limits during body parsing.