What is CVE-2026-91990?

CVE-2026-91990 is a high-severity vulnerability in Tornadoweb Tornado, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2026-09-15.

How severe is CVE-2026-91990?

High severity. CVSS v3 base score is 7.5 out of 10.

Resource exhaustion in Tornadoweb Tornado

CVE-2026-91990

Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Tornadoweb Tornado

Weakness classification (CWE)

CWE-770 — Allocation of Resources Without Limits or Throttling

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-91990?: CVE-2026-91990 is a high-severity vulnerability in Tornadoweb Tornado, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2026-09-15.
How severe is CVE-2026-91990?: High severity. CVSS v3 base score is 7.5 out of 10.