CVE-2026-31958

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.

In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts.

Tornado 6.5.5 introduces new limits on the size and complexity of multipart bodies, including a default limit of 100 parts per request. These limits are configurable if needed; see tornado.httputil.ParseMultipartConfig. It is also now possible to disable multipart/form-data parsing entirely if it is not required for the application.

Tornado is an open source version of the scalable, non-blocking web server and tools.

Security Fix(es):

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.(CVE-2026-31958)

Tornado is an open source version of the scalable, non-blocking web server and tools.

Security Fix(es):

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.(CVE-2026-31958)

Tornado is an open source version of the scalable, non-blocking web server and tools.

Security Fix(es):

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.(CVE-2026-31958)

Tornado is an open source version of the scalable, non-blocking web server and tools.

Security Fix(es):

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.(CVE-2026-31958)

Tornado is an open source version of the scalable, non-blocking web server and tools.

Security Fix(es):

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.(CVE-2026-31958)

Tornado is an open source version of the scalable, non-blocking web server and tools.

Security Fix(es):

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.(CVE-2026-31958)

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

• tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

• tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

• tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

• tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-31958 in the tornado package for Root:PyPI. Multiple fixed versions available.

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)
• tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)
• tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)
• tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)
• tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

TuxCare rebuilt tornado to address 6 CVEs. Fixed in 6.1.0.post2+tuxcare.

• CVE-2025-46727: unbounded query parsing in bundled rack; a body of repeated keys was parsed in full, exhausting memory. Capped by rack's new query bytesize and parameter-count limits, which pcsd turns into an HTTP 400
• CVE-2025-59830: the same unbounded query parse reached through ';' separated query strings, which rack's parameter counter did not count
• CVE-2025-61770: multipart parsing in bundled rack read the whole request body searching for a boundary that never arrived
• CVE-2025-61771: multipart parsing in bundled rack retained an unbounded non-file field in memory
• CVE-2025-61772: multipart mime part headers in bundled rack were read with no size limit
• CVE-2025-61919: Rack::Request#POST read the entire request body before any limit applied, so a 64 MB body was fully buffered
• CVE-2024-49761: quadratic regular expression in bundled rexml BaseParser#unnormalize; a long run of zeros in a hex character reference made the parser hang
• CVE-2024-52804: quadratic cookie unquoting in bundled tornado _unquote_cookie, which rescanned the value from each escape
• CVE-2025-47287: malformed multipart/form-data in bundled tornado logged a warning per bad part instead of rejecting the request, flooding the log
• CVE-2026-31958: unbounded part count and part header size in bundled tornado multipart parsing
• Stop forwarding client HTTP headers from the Tornado front end to the Ruby part of pcsd, which only ever needed the cookie and the content type

• Update bundled rubygem rack to 2.2.20
• CVE-2024-25126: fix ReDoS in Rack::MediaType content type parsing
• CVE-2024-26141: fix response amplification from crafted Range headers
• CVE-2024-26146: fix ReDoS in Accept and Forwarded header parsing
• CVE-2025-46727: fix unbounded parameter count in Rack::QueryParser
• CVE-2025-59830: fix params_limit bypass via semicolon-separated parameters
• CVE-2025-61770: fix unbounded multipart preamble buffering
• CVE-2025-61771: fix unbounded buffering of non-file multipart fields
• CVE-2025-61772: fix unbounded multipart part header buffering
• CVE-2025-61919: fix unbounded form body read in Rack::Request#POST
• Handle Rack::QueryParser::QueryLimitError in pcsd, returning 400 instead of 500
• CVE-2026-31958: cap multipart part count and part header size in bundled tornado
• Disable multipart request parsing in pcsd, which does not use it
• Drop i686 from ExclusiveArch: the bundled web UI needs npm at build time and npm has no i686 build, so the i686 buildroot cannot be created

• Update bundled rubygem rack to 2.2.20
• CVE-2024-25126: fix ReDoS in Rack::MediaType content type parsing
• CVE-2024-26141: fix response amplification from crafted Range headers
• CVE-2024-26146: fix ReDoS in Accept and Forwarded header parsing
• CVE-2025-46727: fix unbounded parameter count in Rack::QueryParser
• CVE-2025-59830: fix params_limit bypass via semicolon-separated parameters
• CVE-2025-61770: fix unbounded multipart preamble buffering
• CVE-2025-61771: fix unbounded buffering of non-file multipart fields
• CVE-2025-61772: fix unbounded multipart part header buffering
• CVE-2025-61919: fix unbounded form body read in Rack::Request#POST
• Handle Rack::QueryParser::QueryLimitError in pcsd, returning 400 instead of 500
• CVE-2026-31958: cap multipart part count and part header size in bundled tornado
• Disable multipart request parsing in pcsd, which does not use it
• Drop i686 from ExclusiveArch: the bundled web UI needs npm at build time and npm has no i686 build, so the i686 buildroot cannot be created

TuxCare rebuilt tornado to address 15 CVEs. Fixed in 5.1.1.post4+tuxcare.

• CVE-2026-31958: cap multipart part count and part header size in bundled tornado, and stop accepting multipart requests in pcsd
• CVE-2024-52804: fix quadratic cookie parsing in bundled tornado
• CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado

Tornado has a DoS due to too many multipart parts. (CVE-2026-31958) In Tornado, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters. (CVE-2026-35536)

These are all security issues fixed in the python311-tornado6-6.5.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-salt-3006.0-56.1 package on the GA media of openSUSE Tumbleweed.

This update for python-tornado6 fixes the following issues:

• CVE-2026-31958: parsing large multipart bodies with many parts can cause a denial of service (bsc#1259553).
• incomplete validation of cookie attributes allows for injection of user-controlled values in other cookie attributes (bsc#1259630).

This update for salt fixes the following issues:

Security fixes:

• CVE-2026-31958: python-tornado: parsing large multipart bodies with many parts can cause a denial of service (bsc#1259554)

Other changes in salt:

• Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)
• Harden Tornado from invalid HTTP reason phrases
• Read full URI from ldap pillar config (bsc#1254900)
• Make users with backslash working for salt-ssh (bsc#1254629)
• Fixed ansible.playbooks extra-vars quoting (bsc#1257831)
• Fixed virtualenv call in test helper to use proper python version

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2026-31958: tornado: Fixed parsing large multipart bodies with many parts can cause a denial of service (bsc#1259554)
  • CVE-2026-27459: pyOpenSSL: Fixed issue with large cookie value that can lead to a buffer overflow (bsc#1259808)
  • CVE-2026-27448: pyOpenSSL: Fixed unhandled exception can result in connection not being cancelled (bsc#1259804)

• Other updates and bugfixes:

  • Use non vendored Tornado with Python 3.11 (bsc#1257583, bsc#1259700)
  • Hardened Tornado from invalid HTTP reason phrases
  • Read full URI from ldap pillar config (bsc#1254900)
  • Make users with backslash work for salt-ssh (bsc#1254629).
  • Fixed ansible.playbooks extra-vars quoting (bsc#1257831),
  • Fixed virtualenv call in test helper to use proper Python version.
  • Fixed the issue preventing SELinux profile to be loaded on SLES 16 deployed using cloud images (bsc#1258957)

This update for python-tornado6 fixes the following issues:

• CVE-2026-31958: parsing large multipart bodies with many parts can cause a denial of service (bsc#1259553).
• incomplete validation of cookie attributes allows for injection of user-controlled values in other cookie attributes (bsc#1259630).