CVE-2026-31958

CVE-2026-31958 is a Denial-of-Service (DoS) vulnerability affecting Tornado, a Python web framework, in versions prior to 6.5.5. The flaw allows an attacker to trigger resource exhaustion by sending a multipart/form-data request with an excessive number of parts, as parsing occurs synchronously on the main thread without an adequate limit. Rated 7.5 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), this vulnerability can be exploited remotely by an unauthenticated attacker with low complexity, leading to a complete denial of service. There is no evidence of active exploitation, nor are public exploit codes available on platforms like Metasploit or ExploitDB. While not on the CISA KEV catalog, the vulnerability has been noted in community discussions, including GitHub remediation efforts and a SUSE security update.