CVE-2026-91990
HighAdvisory
Published 1 Sept 2026In the index since 16 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.7
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 115
- of 17,790 indexed, latest versions
- Container images
- 119
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)
Carried by container images the latest versions of 115 of 17,790 indexed charts deploy, on 119 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| python-tornadodeb | 6.2.0-3+deb12u1 | no fix listed | 1 |
| tornadopypi | 2.4.1, 4.5.3, 5.1.1, 6.0.2+14 more | 6.5.8 | 119 |
- OSV records
- DEBIAN-CVE-2026-91990GHSA-8423-8fgw-73vq
Charts affected
115 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| safe-transaction-servicesafe-global | 0.1.0 | 1 of 6See more | 16,739 |
| airflowsb-helm-charts | 0.3.0 | 1 of 1See more | 10,237 |
| seldon-deployseldon | 1.4.0 | 1 of 2See more | 22,349 |
| showroom-docs-mcpshowroom-docs-mcpVerified publisher | 2.1.0 | 1 of 4See more | 5,242 |
| backendsignalen | 4.24.0 | 1 of 4See more | 11,711 |
| srebotsrebot | 0.14.0 | 1 of 2See more | 1,565 |
| restful-distributed-lock-managerstakaterVerified publisher | 1.0.4 | 1 of 1See more | 3,117 |
| netforge-besvtechVerified publisher | 0.0.2 | 1 of 3See more | 4,701 |
| icinga2-reportsvtech-public-helm-charts | 1.0.0 | 1 of 1See more | 1,779 |
| tezos-nodetezos-nodeVerified publisher | 1.0.0 | 1 of 4See more | 5,322 |
| synapsetranhailongVerified publisher | 0.1.0 | 1 of 2See more | 3,165 |
| jupyterhubuninettsigma2 | 1.6.0 | 1 of 5See more | 8,642 |
| unmanicvhdirkVerified publisher | 0.1.4 | 1 of 1See more | 9,424 |
| calibre-webvista | 0.1.3 | 1 of 1See more | 7,679 |
| webapp-chartwebappchart | 1.0.0 | 1 of 1See more | 1,202 |
Container images carrying it
119 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| istio/ | 0a5eb4795952 | tornado | 6.5.8 | 2 |
| istio/ | 22a0410f35a8 | tornado | 6.5.8 | 2 |
| opendatacube/ | 668cbb41473c | tornado | 6.5.8 | 2 |
| safeglobal/ | 80db836cc5d5 | tornado | 6.5.8 | 2 |
| alaaamin/ | 46da5844794e | tornado | 6.5.8 | 1 |
| amagdi888/ | d8a10fc8faf6 | tornado | 6.5.8 | 1 |
| amancevice/ | c8c04bfe3d66 | tornado | 6.5.8 | 1 |
| amundsendev/ | 4d98eb21f5f9 | tornado | 6.5.8 | 1 |
| apache/ | 64e58748b6b9 | tornado | 6.5.8 | 1 |
| apache/ | ce90bdc3d2af | tornado | 6.5.8 | 1 |
| apache/ | e5560ad0b86e | tornado | 6.5.8 | 1 |
| apecloud/ | 8ac9947a2c84 | tornado | 6.5.8 | 1 |
| apsl/ | 51e2de5c2c70 | tornado | 6.5.8 | 1 |
| aristidetm/ | 469dbc951224 | tornado | 6.5.8 | 1 |
| aristidetm/ | ccb516cb8474 | tornado | 6.5.8 | 1 |
| baserow/ | 7c00549b3a6f | tornado | 6.5.8 | 1 |
| baserow/ | e0b3c8130b91 | tornado | 6.5.8 | 1 |
| baserow/ | df0c42eb67e8 | tornado | 6.5.8 | 1 |
| bmeares/ | 8e9c5bacaa82 | tornado | 6.5.8 | 1 |
| cheyang/ | 46cc34755493 | tornado | 6.5.8 | 1 |
| copyparty/ | 0a0a8605062c | tornado | 6.5.8 | 1 |
| daskdev/ | 4ecd7bc35500 | tornado | 6.5.8 | 1 |
| daskdev/ | 052630f5ca04 | tornado | 6.5.8 | 1 |
| datagrok/ | 8c2d48c1545c | tornado | 6.5.8 | 1 |
| ddosify/ | a43c5155fa1c | tornado | 6.5.8 | 1 |
| ddosify/ | e5be48b37348 | tornado | 6.5.8 | 1 |
| errbotio/ | 00ee4e0953ab | tornado | 6.5.8 | 1 |
| esphome/ | 3f51ec10e823 | tornado | 6.5.8 | 1 |
| esphome/ | 9ab8cc88b28c | tornado | 6.5.8 | 1 |
| esphome/ | b2c6322700ac | tornado | 6.5.8 | 1 |
| esphome/ | def8b6e4f517 | tornado | 6.5.8 | 1 |
| factly/ | ca5bc71d1d5c | tornado | 6.5.8 | 1 |
| geoscienceaustralia/ | f4039b45572a | tornado | 6.5.8 | 1 |
| gethue/ | 11b649636e68 | tornado | 6.5.8 | 1 |
| gethue/ | 5702b2c37ff9 | tornado | 6.5.8 | 1 |
| gethue/ | 7d5c1b9f8a79 | tornado | 6.5.8 | 1 |
| gmaas2/ | 148fc2d9afe9 | tornado | 6.5.8 | 1 |
| grafana/ | 499851658393 | tornado | 6.5.8 | 1 |
| homeassistant/ | 021e2afc6e57 | tornado | 6.5.8 | 1 |
| homeassistant/ | 8d000332b09b | tornado | 6.5.8 | 1 |
| ilum/ | ce5dcdeb22ba | tornado | 6.5.8 | 1 |
| intel/ | aa8f5483a2ef | tornado | 6.5.8 | 1 |
| intelowlproject/ | 0b22e547ea6b | tornado | 6.5.8 | 1 |
| istio/ | 6668bcf42ef0 | tornado | 6.5.8 | 1 |
| jaedb/ | 048cfbf58d57 | python-tornado tornado | no fix listed 6.5.8 | 1 |
| josh5/ | 4d49c4816260 | tornado | 6.5.8 | 1 |
| jupyterhub/ | 3974ba945e65 | tornado | 6.5.8 | 1 |
| jupyterhub/ | 5a0ceed1300a | tornado | 6.5.8 | 1 |
| jupyterhub/ | b6b4a1a34bf0 | tornado | 6.5.8 | 1 |
| jupyterhub/ | e4770285aaf7 | tornado | 6.5.8 | 1 |