CVE-2026-91990
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Sep 15, 2026
Vendor
unknown
Description
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.