AZL-105372
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-105372.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-105372
- Upstream
- Published
- 2026-10-01T11:17:20Z
- Modified
- 2026-10-05T05:32:41Z
- Summary
- CVE-2026-103261 affecting package python-tornado 6.3.3-11
- Details
-
Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.init, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts to degrade response times for all clients sharing the same IOLoop.
- References