{"id":"CVE-2026-31958","aliases":["ALSA-2026:13641","ALSA-2026:13670","ALSA-2026:19034","ALSA-2026:19189","ALSA-2026:8093","BELL-CVE-2026-31958","CLSA-2026-1776386115","CLSA-2026-1790243751","CLSA-2026-1790610331","CLSA-2026-1790610419","CLSA-2026-1790675116","CLSA-2026-1792168002","DEBIAN-CVE-2026-31958","EUVD-2026-11323","GHSA-753j-mpmx-qq6g","GHSA-78cv-mqj4-43f7","GHSA-8423-8fgw-73vq","GHSA-pw6j-qg29-8w7f","GHSA-qjxf-f2mg-c6mc","GHSA-qppv-j76h-2rpx","GHSA-w235-7p84-xx57","MGASA-2026-0216","OESA-2026-1673","OESA-2026-1674","OESA-2026-1675","OESA-2026-1676","OESA-2026-1677","OESA-2026-1995","PYSEC-2026-140","RHSA-2026:11454","RHSA-2026:11493","RHSA-2026:11494","RHSA-2026:11495","RHSA-2026:13641","RHSA-2026:13670","RHSA-2026:19034","RHSA-2026:19189","RHSA-2026:20572","RHSA-2026:20573","RHSA-2026:20577","RHSA-2026:20810","RHSA-2026:24342","RHSA-2026:8093","RLSA-2026:13641","RLSA-2026:13670","RLSA-2026:19034","RLSA-2026:19189","RLSA-2026:8093","SUSE-EL-9-CLIENT-TOOLS-2026-2255","SUSE-SU-2026:1064-1","SUSE-SU-2026:1162-1","SUSE-SU-2026:1171-1","SUSE-SU-2026:1519-1","SUSE-SU-2026:1520-1","SUSE-SU-2026:1521-1","SUSE-SU-2026:1523-1","SUSE-SU-2026:1525-1","SUSE-SU-2026:20761-1","SUSE-SU-2026:20770-1","SUSE-SU-2026:20797-1","SUSE-SU-2026:20919-1","SUSE-SU-2026:21990-1","SUSE-SU-2026:21993-1","SUSE-SU-2026:2242-1","SUSE-SU-2026:2244-1","SUSE-SU-2026:2252-1","SUSE-SU-2026:2255-1","SUSE-SU-2026:2256-1","SUSE-SU-2026:2257-1","SUSE-SU-2026:2265-1","UBUNTU-CVE-2026-31958","USN-8198-1","USN-8198-2","openSUSE-SU-2026:10374-1","openSUSE-SU-2026:10389-1","openSUSE-SU-2026:20406-1","openSUSE-SU-2026:20918-1"],"status":"published","title":"Tornado has a DoS due to too many multipart parts","description":"Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00417,"percentile":0.36284,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-03-11T19:27:23Z","modified":"2026-11-10T17:23:20Z","fixes":[{"ecosystem":"PyPI","package":"tornado","fixed_in":["6.5.5"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:8","package":"pcs","fixed_in":["0.10.18-2.el8_10.9.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"pcs-snmp","fixed_in":["0.10.18-2.el8_10.9.alma.1"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"py3-tornado","fixed_in":["6.5.5-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"py3-tornado","fixed_in":["6.5.5-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-tornado","fixed_in":["6.5.5-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"python-tornado","fixed_in":["6.5-3.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"python-tornado","fixed_in":["6.5-3.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"python-tornado","fixed_in":["6.1-6.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"python-tornado","fixed_in":["6.5-3.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"python-tornado","fixed_in":["6.5-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"python-tornado","fixed_in":["5.0.2-13.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs","fixed_in":["0:0.10.18-2.el8_10.9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs-snmp","fixed_in":["0:0.10.18-2.el8_10.9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs","fixed_in":["0:0.10.18-2.el8_10.9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs-snmp","fixed_in":["0:0.10.18-2.el8_10.9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"pcs","fixed_in":["0:0.10.18-2.el8_10.9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-tornado6","fixed_in":["6.3.2-150400.9.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-tornado6","fixed_in":["6.3.2-150400.9.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-tornado6","fixed_in":["6.3.2-150400.9.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-tornado6","fixed_in":["6.3.2-150400.9.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-tornado6","fixed_in":["6.3.2-150400.9.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-tornado6","fixed_in":["6.3.2-150400.9.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-tornado6","fixed_in":["6.3.2-150400.9.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python-tornado6","fixed_in":["6.3.2-150400.9.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-tornado6","fixed_in":["6.3.2-150400.9.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-tornado6","fixed_in":["6.3.2-150400.9.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python-tornado6","fixed_in":["6.3.2-150400.9.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"python-tornado6","fixed_in":["6.3.2-150400.9.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"python-tornado","fixed_in":["4.5.3-150000.3.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"python-tornado","fixed_in":["4.5.3-150000.3.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"python-tornado","fixed_in":["4.5.3-150000.3.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python-tornado","fixed_in":["4.5.3-150000.3.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-tornado","fixed_in":["4.5.3-150000.3.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-tornado","fixed_in":["4.5.3-150000.3.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-tornado","fixed_in":["4.5.3-150000.3.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-tornado","fixed_in":["4.5.3-150000.3.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-tornado","fixed_in":["4.5.3-150000.3.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-tornado","fixed_in":["4.5.3-150000.3.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python-tornado","fixed_in":["4.5.3-150000.3.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-tornado","fixed_in":["4.5.3-150000.3.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-tornado","fixed_in":["4.5.3-150000.3.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python-tornado","fixed_in":["4.5.3-150000.3.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"python-tornado","fixed_in":["4.5.3-150000.3.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"golang-github-lusitaniae-apache_exporter","fixed_in":["1.0.10-90002.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy","fixed_in":["3.11.13-90002.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-core","fixed_in":["3.11.13-90002.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-m2crypto","fixed_in":["0.45.1-90002.3.9.2"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyzmq","fixed_in":["25.1.2-90002.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-simplejson","fixed_in":["3.19.1-90002.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-tornado","fixed_in":["6.3.2-90002.4.6.2"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"spacecmd","fixed_in":["5.1.13-90002.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"uyuni-tools","fixed_in":["5.1.26-90002.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"venv-salt-minion","fixed_in":["3006.0-90002.5.12.2"],"sources":["osv"]},{"ecosystem":"SUSE:Multi Linux Manager Tools EL-9","package":"golang-github-lusitaniae-apache_exporter","fixed_in":["1.0.10-90002.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Multi Linux Manager Tools EL-9","package":"spacecmd","fixed_in":["5.1.13-90002.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Multi Linux Manager Tools EL-9","package":"uyuni-tools","fixed_in":["5.1.26-90002.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Multi Linux Manager Tools EL-9","package":"venv-salt-minion","fixed_in":["3006.0-90002.5.12.2"],"sources":["osv"]},{"ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"golang-github-lusitaniae-apache_exporter","fixed_in":["1.0.10-80002.3.6.2"],"sources":["osv"]},{"ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy","fixed_in":["3.11.13-80002.4.9.2"],"sources":["osv"]},{"ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-core","fixed_in":["3.11.13-80002.4.9.2"],"sources":["osv"]},{"ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-m2crypto","fixed_in":["0.45.1-80002.3.9.2"],"sources":["osv"]},{"ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyzmq","fixed_in":["25.1.2-80002.3.9.2"],"sources":["osv"]},{"ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-simplejson","fixed_in":["3.19.1-80002.3.6.2"],"sources":["osv"]},{"ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-tornado","fixed_in":["6.3.2-80002.4.6.2"],"sources":["osv"]},{"ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"spacecmd","fixed_in":["5.1.13-80002.3.9.2"],"sources":["osv"]},{"ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"uyuni-tools","fixed_in":["5.1.26-80002.3.9.2"],"sources":["osv"]},{"ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"venv-salt-minion","fixed_in":["3006.0-80002.5.12.3"],"sources":["osv"]},{"ecosystem":"SUSE:Multi Linux Manager Tools EL-8","package":"golang-github-lusitaniae-apache_exporter","fixed_in":["1.0.10-80002.3.6.2"],"sources":["osv"]},{"ecosystem":"SUSE:Multi Linux Manager Tools EL-8","package":"spacecmd","fixed_in":["5.1.13-80002.3.9.2"],"sources":["osv"]},{"ecosystem":"SUSE:Multi Linux Manager Tools EL-8","package":"uyuni-tools","fixed_in":["5.1.26-80002.3.9.2"],"sources":["osv"]},{"ecosystem":"SUSE:Multi Linux Manager Tools EL-8","package":"venv-salt-minion","fixed_in":["3006.0-80002.5.12.3"],"sources":["osv"]},{"ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"golang-github-lusitaniae-apache_exporter","fixed_in":["1.0.10-70002.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy","fixed_in":["3.11.13-70002.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-core","fixed_in":["3.11.13-70002.4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-m2crypto","fixed_in":["0.45.1-70002.3.9.2"],"sources":["osv"]},{"ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyzmq","fixed_in":["25.1.2-70002.3.9.2"],"sources":["osv"]},{"ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-simplejson","fixed_in":["3.19.1-70002.3.6.2"],"sources":["osv"]},{"ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-tornado","fixed_in":["6.3.2-70002.4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"spacecmd","fixed_in":["5.1.13-70002.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"venv-salt-minion","fixed_in":["3006.0-70002.5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Multi Linux Manager Tools RES-7","package":"golang-github-lusitaniae-apache_exporter","fixed_in":["1.0.10-70002.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Multi Linux Manager Tools RES-7","package":"spacecmd","fixed_in":["5.1.13-70002.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Multi Linux Manager Tools RES-7","package":"venv-salt-minion","fixed_in":["3006.0-70002.5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"venv-salt-minion","fixed_in":["3006.0-120002.5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"venv-salt-minion","fixed_in":["3006.0-150002.5.12.2"],"sources":["osv"]},{"ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"venv-salt-minion","fixed_in":["3006.0-150002.5.12.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"python-tornado6","fixed_in":["6.5-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"python-tornado6","fixed_in":["6.4-slfo.1.1_4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"python-tornado6","fixed_in":["6.4-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-tornado6","fixed_in":["6.5-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-tornado6","fixed_in":["6.5-160000.4.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-tornado","fixed_in":["4.2.1-1ubuntu3.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-tornado","fixed_in":["4.5.3-1ubuntu0.2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-tornado","fixed_in":["6.1.0-3ubuntu0.1~esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"python-tornado","fixed_in":["6.4.0-1ubuntu0.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"python-tornado","fixed_in":["6.4.2-3ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"python-tornado","fixed_in":["6.5.4-0.1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-tornado","fixed_in":["6.0.3+really5.1.1-3ubuntu0.1~esm5"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-tornado6","fixed_in":["6.5.5-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"python-tornado6","fixed_in":["6.5-160000.4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"salt","fixed_in":["3006.0-160000.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"salt-test","fixed_in":["3006.0-160000.5.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.5.4"},{"fixed":"6.5.5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.5-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.5-1.el9_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.5-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.5-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.18-2.el8_10.9.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.18-2.el8_10.9.alma.1"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"py3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.1-r0"},{"fixed":"6.5.5-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"py3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.3-r0"},{"fixed":"6.5.5-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1"},{"fixed":"6.1.0.post2+tuxcare"}]}],"versions":["6.1","6.1.0.post1+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.18-2.el8.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.18-2.el8.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.1"},{"fixed":"5.1.1.post4+tuxcare"}]}],"versions":["5.1.1","5.1.1.post1+tuxcare","5.1.1.post2+tuxcare","5.1.1.post3+tuxcare"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.4-7.el9_2.tuxcare.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.4-7.el9_2.tuxcare.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-3","6.2.0-3+deb12u1","6.2.0-3+deb12u2","6.2.0-3+deb12u3","6.2.0-3+deb12u4","6.3.2-1","6.4.0-1","6.4.0-2","6.4.1-1","6.4.1-2","6.4.1-3","6.4.2-1","6.4.2-2","6.4.2-3","6.5.2-1","6.5.2-2","6.5.2-3","6.5.4-0.1","6.5.4-1","6.5.5-1","6.5.5-2","6.5.5-3","6.5.5-4","6.5.5-5"]},{"source":"osv","ecosystem":"Debian:13","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.2-3","6.4.2-3+deb13u1","6.4.2-3+deb13u2","6.5.2-1","6.5.2-2","6.5.2-3","6.5.4-0.1","6.5.4-1","6.5.5-1","6.5.5-2","6.5.5-3","6.5.5-4","6.5.5-5"]},{"source":"osv","ecosystem":"Debian:14","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.5-1"}]}],"versions":["6.4.2-3","6.5.2-1","6.5.2-2","6.5.2-3","6.5.4-0.1","6.5.4-1"]},{"source":"osv","ecosystem":"PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.5"}]}],"versions":["0.2","1.0","1.1","1.1.1","1.2","1.2.1","2.0","2.1","2.1.1","2.2","2.2.1","2.3","2.4","2.4.1","3.0","3.0.1","3.0.2","3.1","3.1.1","3.2","3.2.1","3.2.2","4.0","4.0.1","4.0.2","4.1","4.1b2","4.2","4.2.1","4.2b1","4.3","4.3b1","4.3b2","4.4","4.4.1","4.4.2","4.4.3","4.4b1","4.5","4.5.1","4.5.2","4.5.3","4.5b1","4.5b2","5.0","5.0.1","5.0.2","5.0a1","5.0b1","5.1","5.1.1","5.1b1","6.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0a1","6.0b1","6.1","6.1b1","6.1b2","6.2","6.2b1","6.2b2","6.3","6.3.1","6.3.2","6.3.3","6.3b1","6.4","6.4.1","6.4.2","6.4b1","6.5","6.5.1","6.5.2","6.5.3","6.5.4","6.5b1"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-1.4.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5-3.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5-3.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-6.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5-3.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-13.oe2003sp4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.5"}]}],"versions":["0.2","1.0","1.1","1.1.1","1.2","1.2.1","2.0","2.1","2.1.1","2.2","2.2.1","2.3","2.4","2.4.1","3.0","3.0.1","3.0.2","3.1","3.1.1","3.2","3.2.1","3.2.2","4.0","4.0.1","4.0.2","4.1","4.1b2","4.2","4.2.1","4.2b1","4.3","4.3b1","4.3b2","4.4","4.4.1","4.4.2","4.4.3","4.4b1","4.5","4.5.1","4.5.2","4.5.3","4.5b1","4.5b2","5.0","5.0.1","5.0.2","5.0a1","5.0b1","5.1","5.1.1","5.1b1","6.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0a1","6.0b1","6.1","6.1b1","6.1b2","6.2","6.2b1","6.2b2","6.3","6.3.1","6.3.2","6.3.3","6.3b1","6.4","6.4.1","6.4.2","6.4b1","6.5","6.5.1","6.5.2","6.5.3","6.5.4","6.5b1"]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.11"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.11"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.11"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.11"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.11"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.11"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.11"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.11"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.13"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.13"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.13"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.13"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.15-4.el8_8.11"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.15-4.el8_8.11"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.15-4.el8_8.11"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.15-4.el8_8.11"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el9_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el9_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el9_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el9_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-2.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-2.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-2.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-2.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-5.el7_9.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"python-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-5.el7_9.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"python-tornado-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-5.el7_9.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10.9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10.9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10.9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10.9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el9_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5.5-1.el9_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10.9"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-1.76.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-17.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-90002.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.13-90002.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.13-90002.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-m2crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.45.1-90002.3.9.2"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyzmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.2-90002.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-90002.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-90002.4.6.2"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.13-90002.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.26-90002.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-90002.5.12.2"}]}]},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-9","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-90002.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-9","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.13-90002.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-9","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.26-90002.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-9","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-90002.5.12.2"}]}]},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-80002.3.6.2"}]}]},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.13-80002.4.9.2"}]}]},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.13-80002.4.9.2"}]}]},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-m2crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.45.1-80002.3.9.2"}]}]},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyzmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.2-80002.3.9.2"}]}]},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-80002.3.6.2"}]}]},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-80002.4.6.2"}]}]},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.13-80002.3.9.2"}]}]},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.26-80002.3.9.2"}]}]},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-80002.5.12.3"}]}]},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-8","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-80002.3.6.2"}]}]},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-8","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.13-80002.3.9.2"}]}]},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-8","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.26-80002.3.9.2"}]}]},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-8","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-80002.5.12.3"}]}]},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-70002.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.13-70002.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.13-70002.4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-m2crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.45.1-70002.3.9.2"}]}]},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyzmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.2-70002.3.9.2"}]}]},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-70002.3.6.2"}]}]},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-70002.4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.13-70002.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-70002.5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools RES-7","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-70002.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools RES-7","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.13-70002.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools RES-7","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-70002.5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-120002.5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150002.5.12.2"}]}]},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150002.5.12.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4-slfo.1.1_4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5-160000.4.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-1ubuntu3.1+esm3"}]}],"versions":["4.2.1-1ubuntu2","4.2.1-1ubuntu3","4.2.1-1ubuntu3.1","4.2.1-1ubuntu3.1+esm1","4.2.1-1ubuntu3.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-1ubuntu0.2+esm3"}]}],"versions":["4.5.1-2.1~build2","4.5.2-1","4.5.3-1","4.5.3-1ubuntu0.1","4.5.3-1ubuntu0.2","4.5.3-1ubuntu0.2+esm1","4.5.3-1ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0-3ubuntu0.1~esm5"}]}],"versions":["6.1.0-1build1","6.1.0-2","6.1.0-3","6.1.0-3build1","6.1.0-3ubuntu0.1~esm1","6.1.0-3ubuntu0.1~esm2","6.1.0-3ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-1ubuntu0.5"}]}],"versions":["6.3.2-1","6.4.0-0ubuntu1","6.4.0-1","6.4.0-1build1","6.4.0-1ubuntu0.1","6.4.0-1ubuntu0.2","6.4.0-1ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-3ubuntu0.3"}]}],"versions":["6.4.2-1","6.4.2-2","6.4.2-2ubuntu1","6.4.2-3","6.4.2-3ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.4-0.1ubuntu0.1"}]}],"versions":["6.4.2-3","6.5.2-3","6.5.4-0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-1ubuntu3.1+esm3"}]}],"versions":["4.2.1-1ubuntu2","4.2.1-1ubuntu3","4.2.1-1ubuntu3.1","4.2.1-1ubuntu3.1+esm1","4.2.1-1ubuntu3.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-1ubuntu0.2+esm3"}]}],"versions":["4.5.1-2.1~build2","4.5.2-1","4.5.3-1","4.5.3-1ubuntu0.1","4.5.3-1ubuntu0.2","4.5.3-1ubuntu0.2+esm1","4.5.3-1ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.3+really5.1.1-3ubuntu0.1~esm5"}]}],"versions":["5.1.1-4ubuntu1","5.1.1-4ubuntu5","6.0.3+really5.1.1-2","6.0.3+really5.1.1-2build1","6.0.3+really5.1.1-2build2","6.0.3+really5.1.1-3","6.0.3+really5.1.1-3ubuntu0.1~esm1","6.0.3+really5.1.1-3ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0-3ubuntu0.1~esm5"}]}],"versions":["6.1.0-1build1","6.1.0-2","6.1.0-3","6.1.0-3build1","6.1.0-3ubuntu0.1~esm1","6.1.0-3ubuntu0.1~esm2","6.1.0-3ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-1ubuntu0.5"}]}],"versions":["6.3.2-1","6.4.0-0ubuntu1","6.4.0-1","6.4.0-1build1","6.4.0-1ubuntu0.1","6.4.0-1ubuntu0.2","6.4.0-1ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-3ubuntu0.3"}]}],"versions":["6.4.2-1","6.4.2-2","6.4.2-2ubuntu1","6.4.2-3","6.4.2-3ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.4-0.1ubuntu0.1"}]}],"versions":["6.4.2-3","6.5.2-3","6.5.4-0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.5-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-56.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5-160000.4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-160000.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"salt-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-160000.5.1"}]}]}],"products":[{"vendor":"tornadoweb","product":"tornado"}],"references":[{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-qjxf-f2mg-c6mc","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/04/msg00000.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31958","tags":["advisory"]},{"url":"https://github.com/tornadoweb/tornado/commit/119a195e290c43ad2d63a2cf012c29d43d6ed839","tags":["web"]},{"url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.5","tags":["web","article"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/tornado/PYSEC-2026-140.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qjxf-f2mg-c6mc"},{"url":"https://access.redhat.com/errata/RHSA-2026:13641","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-31958","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-35536","tags":["report"]},{"url":"https://bugzilla.redhat.com/2446765","tags":["report"]},{"url":"https://bugzilla.redhat.com/2454716","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-13641.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13670","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-13670.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19034","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-19034.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19189","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-19189.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8093","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-8093.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-31958","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1790243751.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49761","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52804","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46727","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47287","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59830","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61770","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61771","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61772","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61919","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1790610331.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25126","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26141","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26146","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1790610419.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792168002.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31958.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-31958","tags":["advisory"]},{"url":"https://github.com/tornadoweb/tornado","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0216.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35420","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8198-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1673","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1674","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1675","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1676","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1677","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1995","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11454","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446765","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453496","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11454.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4800","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4800","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4800","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-31958","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11493","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11493.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11494","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11494.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11495","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11495.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2454716","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13641.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-35536","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35536","tags":["advisory"]},{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-78cv-mqj4-43f7","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13670.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19034.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19189.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20572","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20572.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20573","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20573.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20577","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20577.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20810","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20810.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24342","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24342.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8093.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:13641","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:13670","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:19034","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:19189","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:8093","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement//suse-el-9-client-tools-2026-2255/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1254629","tags":["report"]},{"url":"https://bugzilla.suse.com/1254900","tags":["report"]},{"url":"https://bugzilla.suse.com/1257583","tags":["report"]},{"url":"https://bugzilla.suse.com/1257831","tags":["report"]},{"url":"https://bugzilla.suse.com/1258957","tags":["report"]},{"url":"https://bugzilla.suse.com/1259554","tags":["report"]},{"url":"https://bugzilla.suse.com/1259700","tags":["report"]},{"url":"https://bugzilla.suse.com/1259804","tags":["report"]},{"url":"https://bugzilla.suse.com/1259808","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31958","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261064-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259553","tags":["report"]},{"url":"https://bugzilla.suse.com/1259630","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261162-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1254903","tags":["report"]},{"url":"https://bugzilla.suse.com/1254905","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67725","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261171-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261519-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1250367","tags":["report"]},{"url":"https://bugzilla.suse.com/1252548","tags":["report"]},{"url":"https://bugzilla.suse.com/1252964","tags":["report"]},{"url":"https://bugzilla.suse.com/1254154","tags":["report"]},{"url":"https://bugzilla.suse.com/1254619","tags":["report"]},{"url":"https://bugzilla.suse.com/1257447","tags":["report"]},{"url":"https://bugzilla.suse.com/1257660","tags":["report"]},{"url":"https://bugzilla.suse.com/1257941","tags":["report"]},{"url":"https://bugzilla.suse.com/1258015","tags":["report"]},{"url":"https://bugzilla.suse.com/1258418","tags":["report"]},{"url":"https://bugzilla.suse.com/1258927","tags":["report"]},{"url":"https://bugzilla.suse.com/1259208","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261520-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261521-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261523-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261525-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620761-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620770-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620797-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620919-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621990-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261810","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621993-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262242-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262244-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262252-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262255-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262256-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262257-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262265-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1249675","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42154","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-31958","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8198-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-35536","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13836","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-31958","title":"Tornado has a DoS due to too many multipart parts","description":"Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.","status":"published","published":"2026-03-11T19:27:23.38Z","modified":"2026-04-01T14:32:33.146Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:19:51.277563Z"}],"euvd":[{"id":"EUVD-2026-11323","description":"Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.","status":"published","published":"2026-03-11T19:27:23Z","modified":"2026-04-01T14:32:33Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:25:24.493801Z"}],"ghsa":[{"id":"GHSA-qjxf-f2mg-c6mc","title":"Tornado is vulnerable to DoS due to too many multipart parts","description":"In versions of Tornado prior to 6.5.5, the only limit on the number of parts in `multipart/form-data` is the `max_body_size` setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. \n\nTornado 6.5.5 introduces new limits on the size and complexity of multipart bodies, including a default limit of 100 parts per request. These limits are configurable if needed; see `tornado.httputil.ParseMultipartConfig`. It is also now possible to disable `multipart/form-data` parsing entirely if it is not required for the application.","status":"published","published":"2026-03-12T14:19:52Z","modified":"2026-06-08T19:51:13Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:40:18.682012Z"}],"nvd":[{"id":"CVE-2026-31958","description":"Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.","status":"published","published":"2026-03-11T20:16:16.617Z","modified":"2026-06-17T10:34:50.473Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:08.98071Z"}],"osv":[{"id":"BELL-CVE-2026-31958","status":"published","published":"2026-03-13T06:08:20.362268Z","modified":"2026-03-18T08:00:18.936484Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.572955Z"},{"id":"CVE-2026-31958","title":"Tornado has a DoS due to too many multipart parts","description":"Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.","status":"published","published":"2026-03-11T19:27:23.38Z","modified":"2026-10-28T02:31:02.859418713Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:45:01.218144Z"},{"id":"DEBIAN-CVE-2026-31958","description":"Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.","status":"published","published":"2026-03-11T20:16:16.617Z","modified":"2026-10-01T03:03:10.351627713Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.232518Z"},{"id":"GHSA-qjxf-f2mg-c6mc","title":"Tornado is vulnerable to DoS due to too many multipart parts","description":"In versions of Tornado prior to 6.5.5, the only limit on the number of parts in `multipart/form-data` is the `max_body_size` setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. \n\nTornado 6.5.5 introduces new limits on the size and complexity of multipart bodies, including a default limit of 100 parts per request. These limits are configurable if needed; see `tornado.httputil.ParseMultipartConfig`. It is also now possible to disable `multipart/form-data` parsing entirely if it is not required for the application.","status":"published","published":"2026-03-12T14:19:52Z","modified":"2026-09-10T03:50:40.522968763Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"OESA-2026-1673","title":"python-tornado security update","description":"Tornado is an open source version of the scalable, non-blocking web server and tools.\r\n\r\nSecurity Fix(es):\n\nTornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.(CVE-2026-31958)","status":"published","published":"2026-03-20T11:10:42Z","modified":"2026-08-18T01:19:41.451375984Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1674","title":"python-tornado security update","description":"Tornado is an open source version of the scalable, non-blocking web server and tools.\r\n\r\nSecurity Fix(es):\n\nTornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.(CVE-2026-31958)","status":"published","published":"2026-03-20T11:10:42Z","modified":"2026-08-18T01:19:40.427339542Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1675","title":"python-tornado security update","description":"Tornado is an open source version of the scalable, non-blocking web server and tools.\r\n\r\nSecurity Fix(es):\n\nTornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.(CVE-2026-31958)","status":"published","published":"2026-03-20T11:10:42Z","modified":"2026-08-18T01:19:41.636884269Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1676","title":"python-tornado security update","description":"Tornado is an open source version of the scalable, non-blocking web server and tools.\r\n\r\nSecurity Fix(es):\n\nTornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.(CVE-2026-31958)","status":"published","published":"2026-03-20T11:10:42Z","modified":"2026-08-18T01:19:41.68513287Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1677","title":"python-tornado security update","description":"Tornado is an open source version of the scalable, non-blocking web server and tools.\r\n\r\nSecurity Fix(es):\n\nTornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.(CVE-2026-31958)","status":"published","published":"2026-03-20T11:10:42Z","modified":"2026-08-18T01:19:41.351970271Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1995","title":"python-tornado security update","description":"Tornado is an open source version of the scalable, non-blocking web server and tools.\r\n\r\nSecurity Fix(es):\n\nTornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.(CVE-2026-31958)","status":"published","published":"2026-04-25T11:10:59Z","modified":"2026-08-18T01:19:44.460213625Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"PYSEC-2026-140","description":"Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.","status":"published","published":"2026-03-11T20:16:16.617Z","modified":"2026-05-20T09:19:20.297525Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:54.622769Z"},{"id":"RHSA-2026:11454","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2026-04-29T10:06:37Z","modified":"2026-10-16T10:10:25Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:11493","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2026-04-29T10:06:39Z","modified":"2026-10-16T10:10:28Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:11494","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2026-04-29T10:06:39Z","modified":"2026-10-16T10:10:28Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:11495","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2026-04-29T10:06:40Z","modified":"2026-10-16T10:10:29Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:13641","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2026-05-05T10:11:57Z","modified":"2026-10-17T10:09:17Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:13670","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2026-05-06T10:05:28Z","modified":"2026-10-17T10:09:18Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:19034","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2026-05-20T10:09:41Z","modified":"2026-10-17T10:10:11Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:19189","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2026-05-20T10:10:16Z","modified":"2026-10-17T10:10:23Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:20572","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2026-05-26T10:07:33Z","modified":"2026-10-17T10:10:42Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:20573","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2026-05-26T10:07:34Z","modified":"2026-10-17T10:10:43Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:20577","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2026-05-26T10:07:36Z","modified":"2026-10-17T10:10:43Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:20810","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2026-05-27T10:07:24Z","modified":"2026-10-17T10:10:50Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:24342","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2026-06-08T10:06:38Z","modified":"2026-10-17T10:11:19Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:8093","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2026-04-15T10:10:26Z","modified":"2026-10-16T10:26:49Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:13641","title":"Moderate: python-tornado security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)\n\n* tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-06T12:05:16.751656Z","modified":"2026-05-06T12:30:41.823274Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2026:13670","title":"Moderate: python-tornado security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)\n\n* tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-06T06:02:14.811706Z","modified":"2026-05-06T06:30:28.504283Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2026:19034","title":"Moderate: python-tornado security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)\n\n* tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-29T16:03:24.060458Z","modified":"2026-05-29T16:30:08.965816108Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2026:19189","title":"Moderate: python-tornado security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)\n\n* tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-21T16:27:07.11942Z","modified":"2026-05-21T17:00:07.071952908Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:8093","title":"Moderate: pcs security update","description":"The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.\n\nSecurity Fix(es):\n\n* tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-16T12:00:37.623432Z","modified":"2026-04-16T12:30:15.981374Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-31958","description":"Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.","status":"published","published":"2026-03-11T20:16:00Z","modified":"2026-07-22T20:45:49.156207387Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"ALSA-2026:13641","title":"Moderate: python-tornado security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)\n  * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-05T00:00:00Z","modified":"2026-10-29T11:58:14.029138Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:13670","title":"Moderate: python-tornado security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)\n  * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-05T00:00:00Z","modified":"2026-10-29T11:32:30.741908731Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:19034","title":"Moderate: python-tornado security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)\n  * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-19T00:00:00Z","modified":"2026-10-29T11:30:16.097018686Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:19189","title":"Moderate: python-tornado security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)\n  * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-19T00:00:00Z","modified":"2026-10-29T11:32:31.270652242Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:8093","title":"Moderate: pcs security update","description":"The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.  \n\nSecurity Fix(es):  \n\n  * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-14T00:00:00Z","modified":"2026-10-29T11:02:25.146218922Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"CLSA-2026-1776386115","title":"TuxCare security update for tornado (6 CVEs)","description":"TuxCare rebuilt tornado to address 6 CVEs. Fixed in 6.1.0.post2+tuxcare.","status":"published","published":"2026-08-04T14:52:26Z","modified":"2026-10-15T09:48:04.993235199Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1790243751","title":"pcs: Fix of 10 CVEs","description":"- CVE-2025-46727: unbounded query parsing in bundled rack; a body of repeated\n  keys was parsed in full, exhausting memory. Capped by rack's new query\n  bytesize and parameter-count limits, which pcsd turns into an HTTP 400\n- CVE-2025-59830: the same unbounded query parse reached through ';' separated\n  query strings, which rack's parameter counter did not count\n- CVE-2025-61770: multipart parsing in bundled rack read the whole request body\n  searching for a boundary that never arrived\n- CVE-2025-61771: multipart parsing in bundled rack retained an unbounded\n  non-file field in memory\n- CVE-2025-61772: multipart mime part headers in bundled rack were read with no\n  size limit\n- CVE-2025-61919: Rack::Request#POST read the entire request body before any\n  limit applied, so a 64 MB body was fully buffered\n- CVE-2024-49761: quadratic regular expression in bundled rexml\n  BaseParser#unnormalize; a long run of zeros in a hex character reference made\n  the parser hang\n- CVE-2024-52804: quadratic cookie unquoting in bundled tornado\n  _unquote_cookie, which rescanned the value from each escape\n- CVE-2025-47287: malformed multipart/form-data in bundled tornado logged a\n  warning per bad part instead of rejecting the request, flooding the log\n- CVE-2026-31958: unbounded part count and part header size in bundled tornado\n  multipart parsing\n- Stop forwarding client HTTP headers from the Tornado front end to the Ruby\n  part of pcsd, which only ever needed the cookie and the content type","status":"published","published":"2026-09-24T09:56:11Z","modified":"2026-10-26T09:43:44.481328861Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790610331","title":"pcs: Fix of 10 CVEs","description":"- Update bundled rubygem rack to 2.2.20\n- CVE-2024-25126: fix ReDoS in Rack::MediaType content type parsing\n- CVE-2024-26141: fix response amplification from crafted Range headers\n- CVE-2024-26146: fix ReDoS in Accept and Forwarded header parsing\n- CVE-2025-46727: fix unbounded parameter count in Rack::QueryParser\n- CVE-2025-59830: fix params_limit bypass via semicolon-separated parameters\n- CVE-2025-61770: fix unbounded multipart preamble buffering\n- CVE-2025-61771: fix unbounded buffering of non-file multipart fields\n- CVE-2025-61772: fix unbounded multipart part header buffering\n- CVE-2025-61919: fix unbounded form body read in Rack::Request#POST\n- Handle Rack::QueryParser::QueryLimitError in pcsd, returning 400 instead of 500\n- CVE-2026-31958: cap multipart part count and part header size in bundled tornado\n- Disable multipart request parsing in pcsd, which does not use it\n- Drop i686 from ExclusiveArch: the bundled web UI needs npm at build time and\n  npm has no i686 build, so the i686 buildroot cannot be created","status":"published","published":"2026-09-28T15:45:52Z","modified":"2026-10-26T09:31:44.061952334Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790610419","title":"pcs: Fix of 10 CVEs","description":"- Update bundled rubygem rack to 2.2.20\n- CVE-2024-25126: fix ReDoS in Rack::MediaType content type parsing\n- CVE-2024-26141: fix response amplification from crafted Range headers\n- CVE-2024-26146: fix ReDoS in Accept and Forwarded header parsing\n- CVE-2025-46727: fix unbounded parameter count in Rack::QueryParser\n- CVE-2025-59830: fix params_limit bypass via semicolon-separated parameters\n- CVE-2025-61770: fix unbounded multipart preamble buffering\n- CVE-2025-61771: fix unbounded buffering of non-file multipart fields\n- CVE-2025-61772: fix unbounded multipart part header buffering\n- CVE-2025-61919: fix unbounded form body read in Rack::Request#POST\n- Handle Rack::QueryParser::QueryLimitError in pcsd, returning 400 instead of 500\n- CVE-2026-31958: cap multipart part count and part header size in bundled tornado\n- Disable multipart request parsing in pcsd, which does not use it\n- Drop i686 from ExclusiveArch: the bundled web UI needs npm at build time and\n  npm has no i686 build, so the i686 buildroot cannot be created","status":"published","published":"2026-09-28T15:47:19Z","modified":"2026-10-26T09:31:51.622041107Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790675116","title":"TuxCare security update for tornado (15 CVEs)","description":"TuxCare rebuilt tornado to address 15 CVEs. Fixed in 5.1.1.post4+tuxcare.","status":"published","published":"2026-09-29T09:45:16Z","modified":"2026-10-15T09:48:02.299807474Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792168002","title":"pcs: Fix of 3 CVEs","description":"- CVE-2026-31958: cap multipart part count and part header size in bundled tornado, and stop accepting multipart requests in pcsd\n- CVE-2024-52804: fix quadratic cookie parsing in bundled tornado\n- CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado","status":"published","published":"2026-10-16T16:26:53Z","modified":"2026-10-26T09:43:51.563039982Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"MGASA-2026-0216","title":"Updated python-tornado packages fix security vulnerabilities","description":"Tornado has a DoS due to too many multipart parts. (CVE-2026-31958)\nIn Tornado, cookie attribute injection could occur because the domain,\npath, and samesite arguments to .RequestHandler.set_cookie were not\nchecked for crafted characters. (CVE-2026-35536)\n","status":"published","published":"2026-06-17T06:43:54Z","modified":"2026-06-17T06:45:04.038516108Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10374-1","title":"python311-tornado6-6.5.5-1.1 on GA media","description":"These are all security issues fixed in the python311-tornado6-6.5.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-14T00:00:00Z","modified":"2026-03-15T11:45:34.88598Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:10389-1","title":"python311-salt-3006.0-56.1 on GA media","description":"These are all security issues fixed in the python311-salt-3006.0-56.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-18T00:00:00Z","modified":"2026-03-19T08:45:08.602829Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20406-1","title":"Security update for python-tornado6","description":"This update for python-tornado6 fixes the following issues:\n\n- CVE-2026-31958: parsing large multipart bodies with many parts can cause a denial of service (bsc#1259553).\n- incomplete validation of cookie attributes allows for injection of user-controlled values in other cookie attributes\n  (bsc#1259630).\n","status":"published","published":"2026-03-20T10:53:33Z","modified":"2026-03-29T17:25:06.56479Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20918-1","title":"Security update for salt","description":"This update for salt fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2026-31958: python-tornado: parsing large multipart bodies with many parts can cause a denial of service (bsc#1259554)\n\nOther changes in salt:\n\n- Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)\n- Harden Tornado from invalid HTTP reason phrases\n- Read full URI from ldap pillar config (bsc#1254900)\n- Make users with backslash working for salt-ssh (bsc#1254629)\n- Fixed ansible.playbooks extra-vars quoting (bsc#1257831)\n- Fixed virtualenv call in test helper to use proper python version\n\n","status":"published","published":"2026-06-08T09:30:18Z","modified":"2026-06-10T18:24:16.243159711Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-EL-9-CLIENT-TOOLS-2026-2255","title":"Security update 5.0.8 for Multi-Linux Manager Salt Bundle","description":"This update fixes the following issues:\n\nvenv-salt-minion:\n\n- Security issues fixed:\n\n  - CVE-2026-31958: tornado: Fixed parsing large multipart bodies with many parts can cause a denial of service\n    (bsc#1259554)\n  - CVE-2026-27459: pyOpenSSL: Fixed issue with large cookie value that can lead to a buffer overflow (bsc#1259808)\n  - CVE-2026-27448: pyOpenSSL: Fixed unhandled exception can result in connection not being cancelled (bsc#1259804)\n\n- Other updates and bugfixes:\n\n  - Use non vendored Tornado with Python 3.11 (bsc#1257583, bsc#1259700)\n  - Hardened Tornado from invalid HTTP reason phrases\n  - Read full URI from ldap pillar config (bsc#1254900)\n  - Make users with backslash work for `salt-ssh` (bsc#1254629).\n  - Fixed `ansible.playbooks` `extra-vars` quoting (bsc#1257831),\n  - Fixed `virtualenv` call in test helper to use proper Python version.\n  - Fixed the issue preventing SELinux profile to be loaded on SLES 16\n    deployed using cloud images (bsc#1258957)\n\n","status":"published","published":"2026-06-03T14:19:09Z","modified":"2026-07-24T18:24:21.599683961Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2026:1064-1","title":"Security update for python-tornado6","description":"This update for python-tornado6 fixes the following issues:\n\n- CVE-2026-31958: parsing large multipart bodies with many parts can cause a denial of service (bsc#1259553).\n- incomplete validation of cookie attributes allows for injection of user-controlled values in other cookie attributes\n  (bsc#1259630).\n","status":"published","published":"2026-03-26T10:37:23Z","modified":"2026-03-27T08:48:28.343492Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1162-1","title":"Security update for python-tornado","description":"This update for python-tornado fixes the following issues:\n\n- CVE-2025-67724: missing validation of the supplied reason phrase (bsc#1254903).\n- CVE-2025-67725: Denial of Service (DoS) via maliciously crafted HTTP request caused by the HTTPHeaders.add method\n  (bsc#1254905).\n- CVE-2026-31958: parsing large multipart bodies with many parts can cause a denial of service (bsc#1259553).\n- incomplete validation of cookie attributes allows for injection of user-controlled values in other cookie attributes\n  (bsc#1259630).\n","status":"published","published":"2026-03-31T22:02:18Z","modified":"2026-11-10T17:23:20.362397482Z","updated_at":"2026-11-10T17:35:04.393608Z"}]},"sources_more":{"osv":21}}