Announcing Tornado 6.5.8

[Ben Darnell]

I am pleased to announce the availability of Tornado 6.5.8, which fixes a significant DoS vulnerability in request parsing, along with two less-severe vulnerabilities. Also note that OpenIdMixin will be deleted in a future release; if you're still using it please let me know. 

What’s new in Tornado 6.5.8¶

Aug 6, 2026¶

Security fixes¶

• Form-encoded POST bodies are now subject to a limit of 1000 arguments by default. This prevents a CPU and memory denial of service attack. This limit can be overridden via the set_parse_body_config function. Thanks to Arpit Jain for reporting this issue.

• Multipart parsing now rejects requests with an excessive number of parts earlier in the parsing process, limiting memory consumption. Thanks to afldl for reporting this issue.

• The deprecated mixed-case arguments to RequestHandler.set_cookie now enforce the same restrictions on invalid characters that were introduced in Tornado 6.5.5 for the standard lowercase arguments. Thanks to sec-reex and Arpit Jain for reporting this issue.

Deprecations¶

• The OpenIdMixin class is deprecated and will be removed in Tornado 6.7. OpenID 2.0 is no longer widely supported by identity providers.