CVE-2026-91990
Canonical Ubuntu Linux: denial of service
- Risk score
- 62/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 15 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.
- Affected
- Canonical Ubuntu Linux before 6.5.8
- Fix
- Upgrade Canonical Ubuntu Linux to 6.5.8 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 7.5 high
- Remotely exploitable without logging in
- Named in a government or vendor bulletin
Government and vendor bulletins
References
Original description
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.
Last activity 22 Oct 2026. Patch Forecast updates every hour.