{"id":"AZL-98544","summary":"CVE-2026-82397 affecting package python-tornado 6.3.3-11","details":"Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.","modified":"2026-09-03T14:17:00.190454404Z","published":"2026-08-31T22:17:22Z","upstream":["CVE-2026-82397"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82397"}],"affected":[{"package":{"name":"python-tornado","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/python-tornado"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.3.3-11"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-98544.json"}}],"schema_version":"1.9.0"}