Debian 11 python-tornado Critical DoS Risk Mitigation DLA-4520-1

CVE-2026-31958


Introduce new limits on the size and complexity of multipart bodies,
including a default limit of 100 parts per request to mitigate a
possible DoS. It is also possible to disable parsing multipart/form-
data entirely if not required

GHSA-78cv-mqj4-43f7 (CVE not available yet)

Values passed to the domain, path, and samesite arguments of
RequestHandler.set_cookie are not completely validated. In
particular, semicolons are allowed, which could be used to inject
attacker-controlled values for other cookie attributes.

For Debian 11 bullseye, this problem has been fixed in version
6.1.0-1+deb11u4.

We recommend that you upgrade your python-tornado packages.

For the detailed security status of python-tornado please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/python-tornado

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be