Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8952-1 advisory.

    It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An     attacker could possibly use these issues to cause a denial of service, expose sensitive information, or     bypass access controls.

    (CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992, CVE-2026-103262, CVE-2026-103263)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:80741 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects     (CVE-2026-49853)

    * tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption     (CVE-2026-49855)

    * tornado: Tornado: Denial of Service via memory amplification in multipart parsing (CVE-2026-91990)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3177 advisory.

    Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that     splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests     with many parts to create large transient lists, exhausting server memory and causing denial of service.
    (CVE-2026-91990)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python3-tornado installed on the remote host is prior to 5.0.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3975 advisory.

    Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that     splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests     with many parts to create large transient lists, exhausting server memory and causing denial of service.
    (CVE-2026-91990)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3176 advisory.

    Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that     splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests     with many parts to create large transient lists, exhausting server memory and causing denial of service.
    (CVE-2026-91990)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python-tornado installed on the remote host is prior to 4.2.1-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3976 advisory.

    Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that     splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests     with many parts to create large transient lists, exhausting server memory and causing denial of service.
    (CVE-2026-91990)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1077 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-91990:
    Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that     splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests     with many parts to create large transient lists, exhausting server memory and causing denial of service.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4404-1 advisory.

    - CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper     parsing of       Content-Length headers accepting non-standard characters. At (bsc#1280689).
    - CVE-2024-58384: CRLF injection in CurlAsyncHTTPClient headers (bsc#1281059).
    - CVE-2026-91990: splitting of multipart data before validation of the `max_parts` limit allows for     resource exhaustion       and a denial of service (bsc#1281439).
    - CVE-2026-91991: incomplete fix for cookie attribute injection allows for cookie validation bypass via     semicolon-       delimited data in capitalized parameters (bsc#1281440).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4403-1 advisory.

    - CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper     parsing of       Content-Length headers accepting non-standard characters. At (bsc#1280689).
    - CVE-2024-58384: CRLF injection in CurlAsyncHTTPClient headers (bsc#1281059).
    - CVE-2026-91990: splitting of multipart data before validation of the `max_parts` limit allows for     resource exhaustion       and a denial of service (bsc#1281439).
    - CVE-2026-91991: incomplete fix for cookie attribute injection allows for cookie validation bypass via     semicolon-       delimited data in capitalized parameters (bsc#1281440).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1056 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-91990:
    Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that     splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests     with many parts to create large transient lists, exhausting server memory and causing denial of service.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that     splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests     with many parts to create large transient lists, exhausting server memory and causing denial of service.
    (CVE-2026-91990)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:67147 advisory.

    * tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects     (CVE-2026-49853)
      * tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption     (CVE-2026-49855)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:67146 advisory.

    * tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects     (CVE-2026-49853)
      * tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption     (CVE-2026-49855)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
371124	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : Tornado vulnerabilities (USN-8952-1)	Nessus	Ubuntu Local Security Checks	Local	critical
369250	RHEL 10 : python-tornado (RHSA-2026:80741)	Nessus	Red Hat Local Security Checks	Local	high
365290	Amazon Linux 2023 : python3-tornado (ALAS2023-2026-3177)	Nessus	Amazon Linux Local Security Checks	Local	high
365271	Amazon Linux 2 : python3-tornado (ALAS-2026-3975)	Nessus	Amazon Linux Local Security Checks	Local	high
365263	Amazon Linux 2023 : python3.13-tornado (ALAS2023-2026-3176)	Nessus	Amazon Linux Local Security Checks	Local	high
365202	Amazon Linux 2 : python-tornado (ALAS-2026-3976)	Nessus	Amazon Linux Local Security Checks	Local	high
365136	TencentOS Server 4: pcs (TSSA-2026:1077)	Nessus	Tencent Local Security Checks	Local	high
362577	SUSE SLED15 / SLES15 Security Update : python-tornado (SUSE-SU-2026:4404-1)	Nessus	SuSE Local Security Checks	Local	critical
362544	SUSE SLED15 / SLES15 Security Update : python-tornado6 (SUSE-SU-2026:4403-1)	Nessus	SuSE Local Security Checks	Local	critical
353450	TencentOS Server 4: python-tornado (TSSA-2026:1056)	Nessus	Tencent Local Security Checks	Local	high
345964	Linux Distros Unpatched Vulnerability : CVE-2026-91990	Nessus	Misc.	Local	high
345943	AlmaLinux 10 : python-tornado (ALSA-2026:67147)	Nessus	Alma Linux Local Security Checks	Local	high
345933	AlmaLinux 9 : python-tornado (ALSA-2026:67146)	Nessus	Alma Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-91990

high

Tenable Plugins

critical

high

high

high

high

high

high

critical

critical

high

high

high

high