CVE-2026-103261

5.3 MEDIUMpublic exploit available

Published 2026-10-01 · Updated 2026-10-01

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts to degrade response times for all clients sharing the same IOLoop.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses

CWE-770

Public exploit & PoC references

https://github.com/tornadoweb/tornado/commit/03945136ea9746eccf61caf88edae39642e59c93
https://github.com/tornadoweb/tornado/security/advisories/GHSA-3hv7-mjh2-fv65

All references

https://github.com/tornadoweb/tornado/commit/03945136ea9746eccf61caf88edae39642e59c93
https://github.com/tornadoweb/tornado/security/advisories/GHSA-3hv7-mjh2-fv65
https://www.vulncheck.com/advisories/tornado-before-6.5.9-denial-of-service-via-query-string

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2023-54404PoC
MEDIUMCVE-2025-12767
UNSCOREDCVE-2025-8352
MEDIUMCVE-2026-100274
MEDIUMCVE-2026-100350PoC
MEDIUMCVE-2026-100508
MEDIUMCVE-2026-100600PoC
LOWCVE-2026-100649PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.