BREW-SNAKEVIZ-GHSA-8423-… (GHSA-8423-8FGW-73VQ)
Vulnerability from osv_homebrew – Published: 2026-09-02 09:57 – Updated: 2026-09-17 19:58 – Source website
VLAI
Summary
tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)
Details
Description
Summary
parse_multipart_form_data (httputil.py:34) calls
data.split(b"--"+boundary+b"\r\n") before the max_parts check (:35).
A 600KB body with 100k parts creates a 100k-element transient list first,
then rejects transient memory amplification (each split element is a copy).
Pre-auth HTTP DoS.
Root cause
parts = data[:final_boundary_index].split(b"--" + boundary + b"\r\n") # :34 huge list first
if len(parts) > config.max_parts: # :35 check after
raise HTTPInputError("multipart/form-data has too many parts")
PoC
gist: https://gist.github.com/afldl/649861f25d39b53b7edbe0298e171617
poc.py + output.txt (100k parts from 600KB transient list).
Fix
Count separators without materializing the list (e.g. data.count(b"--"+boundary) first).
Credit
Reported by afldl, 2026-07.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "tornado",
"resource_purl": "pkg:pypi/tornado@6.5.8",
"upstream_fixed_in": "6.5.8"
},
"package": {
"ecosystem": "Homebrew",
"name": "snakeviz",
"purl": "pkg:brew/snakeviz"
},
"ranges": [
{
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.2_5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/tornado@6.5.8",
"name": "tornado",
"resource": "tornado",
"strategy": "registry",
"subject_version": "6.5.8"
}
]
},
"details": "## Description\n\n### Summary\n\n`parse_multipart_form_data` (httputil.py:34) calls\n`data.split(b\"--\"+boundary+b\"\\r\\n\")` **before** the `max_parts` check (:35).\nA 600KB body with 100k parts creates a 100k-element transient list first,\nthen rejects transient memory amplification (each split element is a copy).\nPre-auth HTTP DoS.\n\n### Root cause\n\n```python\nparts = data[:final_boundary_index].split(b\"--\" + boundary + b\"\\r\\n\") # :34 huge list first\nif len(parts) \u003e config.max_parts: # :35 check after\n raise HTTPInputError(\"multipart/form-data has too many parts\")\n```\n\n### PoC\n\ngist: https://gist.github.com/afldl/649861f25d39b53b7edbe0298e171617\n`poc.py` + `output.txt` (100k parts from 600KB transient list).\n\n### Fix\n\nCount separators without materializing the list (e.g. `data.count(b\"--\"+boundary)` first).\n\n### Credit\n\nReported by afldl, 2026-07.",
"id": "BREW-snakeviz-GHSA-8423-8fgw-73vq",
"modified": "2026-09-17T19:58:46Z",
"published": "2026-09-02T09:57:41Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq"
},
{
"type": "WEB",
"url": "https://github.com/tornadoweb/tornado/pull/3704"
},
{
"type": "WEB",
"url": "https://github.com/tornadoweb/tornado/commit/de85b3f87446e323e881bbaa3d5a74f4b76e5f05"
},
{
"type": "WEB",
"url": "https://gist.github.com/afldl/649861f25d39b53b7edbe0298e171617"
},
{
"type": "PACKAGE",
"url": "https://github.com/tornadoweb/tornado"
},
{
"type": "WEB",
"url": "https://github.com/tornadoweb/tornado/releases/tag/v6.5.8"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "tornado: multipart split() creates huge temp list before max_parts check -\u003e memory amplification DoS (httputil.py:34)",
"upstream": [
"GHSA-8423-8fgw-73vq",
"CVE-2026-91990"
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…