chore(deps): update dependency tornado to v6.5.8 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
tornado (source)	project.dependencies	patch	6.5.7 → 6.5.8

---

Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive **kwargs path in set_cookie

GHSA-wwv5-g3v4-889x

More information

Details

Summary

The CVE-2026-35536 fix added a validation loop that rejects [\x00-\x20\x3b\x7f], but only for the
hardcoded lowercase keys name/domain/path/samesite. The still-live deprecated **kwargs path
writes attacker-supplied attribute values straight into the Morsel with no validation, and because
Morsel.__setitem__ is case-insensitive, a capitalized kwarg (Domain=, Path=, SameSite=, Max-Age=)
routes to the same reserved attribute while bypassing the loop — re-opening ;-delimited attribute injection.

self.set_cookie("sid", "abc", Domain="evil.com; Secure; SameSite=None")

#####  -> Set-Cookie: sid=abc; Domain=evil.com; Secure; SameSite=None; Path=/
##### Sanity (the canonical lowercase named arg IS blocked):
self.set_cookie("sid", "abc", domain="evil.com; Secure")   # -> http.cookies.CookieError

The patch's regression test (SetCookieForbiddenCharHandler) only exercises the four named params, never the
**kwargs path, so the gap is not regression-covered.

Affected code

• tornado/web.py → RequestHandler.set_cookie: the validation loop covers only the lowercase named args;
  the trailing if kwargs: loop does morsel[k] = v with no character validation.

Steps to reproduce

GET /upper (uses Domain= kwarg) emits Set-Cookie: c_upper=v; Domain=evil.com; Secure; SameSite=None; Path=/; GET /lower (uses lowercase
domain=) returns a CookieError.

Impact

Injection of independent cookie attributes (force/drop Secure/HttpOnly/SameSite, rebind Domain/Path)
— the same impact CVE-2026-35536 closed, via the sibling path the patch missed. Conditional on the app using
a capitalized/legacy keyword.

Suggested remediation

Apply the same [\x00-\x20\x3b\x7f] validation to every entry in the **kwargs loop (after normalizing the
key case), or remove the deprecated kwargs path; add a regression test for capitalized kwargs.

Credit

Reported as part of an incomplete-patch measurement study (responsible disclosure).

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/tornadoweb/tornado/security/advisories/GHSA-wwv5-g3v4-889x
• https://github.com/tornadoweb/tornado/pull/3704
• https://github.com/tornadoweb/tornado/pull/3706
• https://github.com/tornadoweb/tornado/commit/6ef836e43e1278530041376adb32504daa977b91
• https://github.com/tornadoweb/tornado/commit/da284767eae8e1f0484f123b8c3225f6465b09c7
• https://github.com/tornadoweb/tornado/releases/tag/v6.5.8
• https://github.com/advisories/GHSA-wwv5-g3v4-889x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

GHSA-8423-8fgw-73vq

More information

Details

Description

Summary

parse_multipart_form_data (httputil.py:34) calls
data.split(b"--"+boundary+b"\r\n") before the max_parts check (:35).
A 600KB body with 100k parts creates a 100k-element transient list first,
then rejects transient memory amplification (each split element is a copy).
Pre-auth HTTP DoS.

Root cause

parts = data[:final_boundary_index].split(b"--" + boundary + b"\r\n")  # :34  huge list first
if len(parts) > config.max_parts:                                       # :35  check after
    raise HTTPInputError("multipart/form-data has too many parts")

PoC

gist: https://gist.github.com/afldl/649861f25d39b53b7edbe0298e171617
poc.py + output.txt (100k parts from 600KB transient list).

Fix

Count separators without materializing the list (e.g. data.count(b"--"+boundary) first).

Credit

Reported by afldl, 2026-07.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq
• https://github.com/tornadoweb/tornado/pull/3704
• https://github.com/tornadoweb/tornado/commit/de85b3f87446e323e881bbaa3d5a74f4b76e5f05
• https://gist.github.com/afldl/649861f25d39b53b7edbe0298e171617
• https://github.com/tornadoweb/tornado/releases/tag/v6.5.8
• https://github.com/advisories/GHSA-8423-8fgw-73vq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

CVE-2026-82397 / GHSA-mpf4-983q-p7j4

More information

Details

Summary

Tornado parses application/x-www-form-urlencoded bodies with urllib.parse.parse_qs and does not pass max_num_fields. A body made almost entirely of separators produces tens of millions of fields, and the parse happens on the event loop before the handler runs, so a single request stalls the whole server.

Where it is

tornado/escape.py, at HEAD e530031405e2154654dedc4c84d5656b557ea310:

result = urllib.parse.parse_qs(
    qs, keep_blank_values, strict_parsing, encoding="latin1", errors="strict"
)

max_num_fields is the parameter CPython added for exactly this, and it is absent.

The path to it is entirely server-side and pre-dispatch. RequestHandler._execute parses the body at tornado/web.py:1821, which reaches HTTPServerRequest._parse_body at tornado/httputil.py:636, and the urlencoded branch of parse_body_arguments calls parse_qs_bytes at tornado/httputil.py:1030.

The size that reaches it is bounded only by the body cap, which defaults to the stream's max_buffer_size of 104857600 at tornado/iostream.py:239, applied as the request body default at tornado/http1connection.py:136-140. A 100 MB body of separators is around fifty million fields.

Impact

Denial of service against the whole process, not one request. Tornado is single-threaded and the parse is synchronous on the event loop, so every other connection waits. No authentication is needed if any route accepts a form post, which is the normal case.

Suggested fix

Pass a bound:

result = urllib.parse.parse_qs(
    qs, keep_blank_values, strict_parsing, encoding="latin1", errors="strict",
    max_num_fields=max_num_fields,
)

with a conservative default and a way for applications to raise it. CPython raises ValueError when the limit is exceeded, which maps cleanly onto a 400.

Lowering the default body cap for urlencoded specifically would help too, since 100 MB of form fields is not a shape any real client sends.

Why I do not think this is a duplicate

The published tornado advisories cover out-of-bounds access in the C extension, unbounded accumulation of decompressed chunks in AsyncHTTPClient, the Authorization header surviving cross-origin redirects, credential leakage on curl handle reuse, and cookie attribute validation. The decompression one is the nearest in spirit and is on the client side; this is the server parsing a request body. The call is unchanged at HEAD.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/tornadoweb/tornado/security/advisories/GHSA-mpf4-983q-p7j4
• https://nvd.nist.gov/vuln/detail/CVE-2026-82397
• https://github.com/tornadoweb/tornado/pull/3704
• https://github.com/tornadoweb/tornado/commit/8d6363ed7b69d5f0da806efe34d256627a2191de
• https://github.com/tornadoweb/tornado/releases/tag/v6.5.8
• https://github.com/advisories/GHSA-mpf4-983q-p7j4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

tornadoweb/tornado (tornado)

v6.5.8

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.