| Package | Affected versions | Patched versions |
|---|---|---|
| tornado | < 6.5.8 | 6.5.8 |
parse_multipart_form_data (httputil.py:34) calls
data.split(b"--"+boundary+b"\r\n") before the max_parts check (:35).
A 600KB body with 100k parts creates a 100k-element transient list first,
then rejects transient memory amplification (each split element is a copy).
Pre-auth HTTP DoS.
parts = data[:final_boundary_index].split(b"--" + boundary + b"\r\n") # :34 huge list first
if len(parts) > config.max_parts: # :35 check after
raise HTTPInputError("multipart/form-data has too many parts")
gist: https://gist.github.com/afldl/649861f25d39b53b7edbe0298e171617
poc.py + output.txt (100k parts from 600KB transient list).
Count separators without materializing the list (e.g. data.count(b"--"+boundary) first).
Reported by afldl, 2026-07.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free