AIKIDO-2026-380869

TL;DR

Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs without passing a max_num_fields bound. A body composed almost entirely of separators produces tens of millions of fields, and this parsing runs synchronously on the event loop before any handler executes. Because the server is single-threaded, one such request stalls the whole process and blocks every other connection. The fix limits form-encoded bodies to a bounded number of arguments by default.