CVE-2026-103261
1 advisory.
PyPI/tornado CVE-2026-103261: medium 5.3
Tornado: Unbounded query-string argument count allows event-loop-stalling DoS
Action: Upgrade tornado to 6.5.9 or later.
pip install tornado==6.5.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.5.9 | - |
Fixed versions
| 6.5.9 |
Sources
- osv: GHSA-3hv7-mjh2-fv65
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-3hv7-mjh2-fv65
- https://github.com/tornadoweb/tornado/pull/3719
- https://github.com/tornadoweb/tornado/commit/03945136ea9746eccf61caf88edae39642e59c93
- https://github.com/tornadoweb/tornado/commit/8a61dd6005f42733015160f3c23a2bcffe200542
- https://github.com/tornadoweb/tornado
- https://github.com/tornadoweb/tornado/releases/tag/v6.5.9
CVE-2026-103261 · published · modified · JSON