Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4404-1 advisory.

    - CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper     parsing of       Content-Length headers accepting non-standard characters. At (bsc#1280689).
    - CVE-2024-58384: CRLF injection in CurlAsyncHTTPClient headers (bsc#1281059).
    - CVE-2026-91990: splitting of multipart data before validation of the `max_parts` limit allows for     resource exhaustion       and a denial of service (bsc#1281439).
    - CVE-2026-91991: incomplete fix for cookie attribute injection allows for cookie validation bypass via     semicolon-       delimited data in capitalized parameters (bsc#1281440).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4403-1 advisory.

    - CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper     parsing of       Content-Length headers accepting non-standard characters. At (bsc#1280689).
    - CVE-2024-58384: CRLF injection in CurlAsyncHTTPClient headers (bsc#1281059).
    - CVE-2026-91990: splitting of multipart data before validation of the `max_parts` limit allows for     resource exhaustion       and a denial of service (bsc#1281439).
    - CVE-2026-91991: incomplete fix for cookie attribute injection allows for cookie validation bypass via     semicolon-       delimited data in capitalized parameters (bsc#1281440).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1056 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-91990:
    Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that     splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests     with many parts to create large transient lists, exhausting server memory and causing denial of service.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that     splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests     with many parts to create large transient lists, exhausting server memory and causing denial of service.
    (CVE-2026-91990)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
362577	SUSE SLED15 / SLES15 Security Update : python-tornado (SUSE-SU-2026:4404-1)	Nessus	SuSE Local Security Checks	Local	critical
362544	SUSE SLED15 / SLES15 Security Update : python-tornado6 (SUSE-SU-2026:4403-1)	Nessus	SuSE Local Security Checks	Local	critical
353450	TencentOS Server 4: python-tornado (TSSA-2026:1056)	Nessus	Tencent Local Security Checks	Local	high
345964	Linux Distros Unpatched Vulnerability : CVE-2026-91990	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-91990

high

Tenable Plugins

critical

critical

high

high