Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:1171-1 advisory.

    - CVE-2026-31958: parsing large multipart bodies with many parts can cause a denial of service     (bsc#1259553).
    - incomplete validation of cookie attributes allows for injection of user-controlled values in other     cookie attributes       (bsc#1259630).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1528 advisory.

    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the     supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or     in HTML in the default error page (where it could be used for XSS) and can be exploited by passing     untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and     tornado.web.HTTPError, the argument is designed to allow applications to pass custom reason phrases (the     Not Found in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes).
    This issue is fixed in version 6.5.3. (CVE-2025-67724)

    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a     single maliciously crafted HTTP request can block the server's event loop for an extended period, caused     by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same     header name is repeated, causing a Denial of Service (DoS).  Due to Python string immutability, each     concatenation copies the entire string, resulting in O(n2) time complexity. The severity can vary from     high if max_header_size has been increased from its default, to low if it has its default value of 64KB.
    This issue is fixed in version 6.5.3. (CVE-2025-67725)

    Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an     inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The
    _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in     multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted     semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a     Content-Disposition header, the server's CPU usage increases quadratically (O(n2)) during parsing. Due to     Tornado's single event loop architecture, a single malicious request can cause the entire server to become     unresponsive for an extended period. This issue is fixed in version 6.5.3. (CVE-2025-67726)

    Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to     6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default     100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-     service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is     fixed in 6.5.5. (CVE-2026-31958)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python3-tornado installed on the remote host is prior to 5.0.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3213 advisory.

    Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to     6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default     100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-     service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is     fixed in 6.5.5. (CVE-2026-31958)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python-tornado installed on the remote host is prior to 4.2.1-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3214 advisory.

    Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to     6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default     100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-     service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is     fixed in 6.5.5. (CVE-2026-31958)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1502 advisory.

    Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to     6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default     100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-     service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is     fixed in 6.5.5. (CVE-2026-31958)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4520 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4520-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     April 01, 2026                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-tornado     Version        : 6.1.0-1+deb11u4     CVE ID         : CVE-2026-31958     Debian Bug     : 1130507 1132367

    Tornado is a scalable, non-blocking Python web framework and     asynchronous networking library.

    CVE-2026-31958


       Introduce new limits on the size and complexity of multipart bodies,        including a default limit of 100 parts per request to mitigate a        possible DoS. It is also possible to disable parsing multipart/form-        data entirely if not required

    GHSA-78cv-mqj4-43f7 (CVE not available yet)

       Values passed to the domain, path, and samesite arguments of        RequestHandler.set_cookie are not completely validated. In        particular, semicolons are allowed, which could be used to inject        attacker-controlled values for other cookie attributes.

    For Debian 11 bullseye, this problem has been fixed in version     6.1.0-1+deb11u4.

    We recommend that you upgrade your python-tornado packages.

    For the detailed security status of python-tornado please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-tornado

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:1064-1 advisory.

    - CVE-2026-31958: parsing large multipart bodies with many parts can cause a denial of service     (bsc#1259553).
    - incomplete validation of cookie attributes allows for injection of user-controlled values in other     cookie attributes       (bsc#1259630).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to     6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default     100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-     service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is     fixed in 6.5.5. (CVE-2026-31958)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
304850	SUSE SLED15 / SLES15 Security Update : python-tornado (SUSE-SU-2026:1171-1)	Nessus	SuSE Local Security Checks	high
304609	Amazon Linux 2023 : python3.13-tornado (ALAS2023-2026-1528)	Nessus	Amazon Linux Local Security Checks	high
304601	Amazon Linux 2 : python3-tornado, --advisory ALAS2-2026-3213 (ALAS-2026-3213)	Nessus	Amazon Linux Local Security Checks	high
304576	Amazon Linux 2 : python-tornado, --advisory ALAS2-2026-3214 (ALAS-2026-3214)	Nessus	Amazon Linux Local Security Checks	high
304575	Amazon Linux 2023 : python3-tornado (ALAS2023-2026-1502)	Nessus	Amazon Linux Local Security Checks	high
304503	Debian dla-4520 : python-tornado-doc - security update	Nessus	Debian Local Security Checks	high
303940	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-tornado6 (SUSE-SU-2026:1064-1)	Nessus	SuSE Local Security Checks	high
301899	Linux Distros Unpatched Vulnerability : CVE-2026-31958	Nessus	Misc.	high

Detections

Analytics

CVE-2026-31958

high

Tenable Plugins

high

high

high

high

high

high

high

high