p PatchFirst

CVE-2026-103261

CVE-2026-103261 · Tornado before 6.5.9 Denial of Service via Query String

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts to degrade response times for all clients sharing the same IOLoop.

CVSS 6.9 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • tornado

    Versions
    • ≥ 0, < 6.5.9: Affected (semver)
    • 6.5.9: Not affected (semver)

    Update to 6.5.9

  • python-tornado Debian:12

    Versions
    • 6.2.0-3
    • 6.2.0-3+deb12u1
    • 6.2.0-3+deb12u2
    • 6.2.0-3+deb12u3
    • 6.2.0-3+deb12u4
    • 6.3.2-1
    • 6.4.0-1
    • 6.4.0-2
    • 6.4.1-1
    • 6.4.1-2
    • 6.4.1-3
    • 6.4.2-1
    • 6.4.2-2
    • 6.4.2-3
    • 6.5.2-1
    • 6.5.2-2
    • 6.5.2-3
    • 6.5.4-0.1
    • 6.5.4-1
    • 6.5.5-1
    • 6.5.5-2
    • 6.5.5-3
    • 6.5.5-4
    • 6.5.5-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-tornado Debian:13

    Versions
    • 6.4.2-3
    • 6.4.2-3+deb13u1
    • 6.4.2-3+deb13u2
    • 6.5.2-1
    • 6.5.2-2
    • 6.5.2-3
    • 6.5.4-0.1
    • 6.5.4-1
    • 6.5.5-1
    • 6.5.5-2
    • 6.5.5-3
    • 6.5.5-4
    • 6.5.5-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-tornado Debian:14

    Versions
    • 6.4.2-3
    • 6.5.2-1
    • 6.5.2-2
    • 6.5.2-3
    • 6.5.4-0.1
    • 6.5.4-1
    • 6.5.5-1
    • 6.5.5-2
    • 6.5.5-3
    • 6.5.5-4
    • 6.5.5-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tornado PyPI

    Versions
    • 0.2
    • 1.0
    • 1.1
    • 1.1.1
    • 1.2
    • 1.2.1
    • 2.0
    • 2.1
    • 2.1.1
    • 2.2
    • 2.2.1
    • 2.3
    • 2.4
    • 2.4.1
    • 3.0
    • 3.0.1
    • 3.0.2
    • 3.1
    • 3.1.1
    • 3.2
    • 3.2.1
    • 3.2.2
    • 4.0
    • 4.0.1
    • 4.0.2
    • 4.1
    • 4.1b2
    • 4.2
    • 4.2.1
    • 4.2b1
    • 4.3
    • 4.3b1
    • 4.3b2
    • 4.4
    • 4.4.1
    • 4.4.2
    • 4.4.3
    • 4.4b1
    • 4.5
    • 4.5.1
    • 4.5.2
    • 4.5.3
    • 4.5b1
    • 4.5b2
    • 5.0
    • 5.0.1
    • 5.0.2
    • 5.0a1
    • 5.0b1
    • 5.1
    • 5.1.1
    • 5.1b1
    • 6.0
    • 6.0.1
    • 6.0.2
    • 6.0.3
    • 6.0.4
    • 6.0a1
    • 6.0b1
    • 6.1
    • 6.1b1
    • 6.1b2
    • 6.2
    • 6.2b1
    • 6.2b2
    • 6.3
    • 6.3.1
    • 6.3.2
    • 6.3.3
    • 6.3b1
    • 6.4
    • 6.4.1
    • 6.4.2
    • 6.4b1
    • 6.5
    • 6.5.1
    • 6.5.2
    • 6.5.3
    • 6.5.4
    • 6.5.5
    • 6.5.6
    • 6.5.7
    • 6.5.8
    • 6.5b1
    Affected ranges
    • ECOSYSTEM: < 6.5.9

    Update to 6.5.9

  • python-tornado Ubuntu:Pro:16.04:LTS

    Versions
    • 4.2.1-1ubuntu2
    • 4.2.1-1ubuntu3
    • 4.2.1-1ubuntu3.1
    • 4.2.1-1ubuntu3.1+esm1
    • 4.2.1-1ubuntu3.1+esm2
    • 4.2.1-1ubuntu3.1+esm3
    • 4.2.1-1ubuntu3.1+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-tornado Ubuntu:Pro:18.04:LTS

    Versions
    • 4.5.1-2.1~build2
    • 4.5.2-1
    • 4.5.3-1
    • 4.5.3-1ubuntu0.1
    • 4.5.3-1ubuntu0.2
    • 4.5.3-1ubuntu0.2+esm1
    • 4.5.3-1ubuntu0.2+esm2
    • 4.5.3-1ubuntu0.2+esm3
    • 4.5.3-1ubuntu0.2+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-tornado Ubuntu:Pro:20.04:LTS

    Versions
    • 5.1.1-4ubuntu1
    • 5.1.1-4ubuntu5
    • 6.0.3+really5.1.1-2
    • 6.0.3+really5.1.1-2build1
    • 6.0.3+really5.1.1-2build2
    • 6.0.3+really5.1.1-3
    • 6.0.3+really5.1.1-3ubuntu0.1~esm1
    • 6.0.3+really5.1.1-3ubuntu0.1~esm3
    • 6.0.3+really5.1.1-3ubuntu0.1~esm5
    • 6.0.3+really5.1.1-3ubuntu0.1~esm7
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-tornado Ubuntu:Pro:22.04:LTS

    Versions
    • 6.1.0-1build1
    • 6.1.0-2
    • 6.1.0-3
    • 6.1.0-3build1
    • 6.1.0-3ubuntu0.1~esm1
    • 6.1.0-3ubuntu0.1~esm2
    • 6.1.0-3ubuntu0.1~esm4
    • 6.1.0-3ubuntu0.1~esm5
    • 6.1.0-3ubuntu0.1~esm6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-tornado Ubuntu:24.04:LTS

    Versions
    • 6.3.2-1
    • 6.4.0-0ubuntu1
    • 6.4.0-1
    • 6.4.0-1build1
    • 6.4.0-1ubuntu0.1
    • 6.4.0-1ubuntu0.2
    • 6.4.0-1ubuntu0.4
    • 6.4.0-1ubuntu0.5
    • 6.4.0-1ubuntu0.6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-tornado Ubuntu:26.10

    Versions
    • 6.5.4-0.1
    • 6.5.5-2
    • 6.5.5-4
    • 6.5.5-5
    • 6.5.5-5ubuntu1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-tornado Ubuntu:26.04:LTS

    Versions
    • 6.4.2-3
    • 6.5.2-3
    • 6.5.4-0.1
    • 6.5.4-0.1ubuntu0.1
    • 6.5.4-0.1ubuntu0.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →