CVE-2026-91990 in Tornado
요약
\~에 의해 MITRE • 2026. 09. 15.
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.
VulDB is the best source for vulnerability data and more expert information about this specific topic.