[GHSA] GHSA-mpf4-983q-p7j4 (high) — Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

GHSA-mpf4-983q-p7j4 Severity: high CVE: CVE-2026-82397

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

## Summary

Tornado parses `application/x-www-form-urlencoded` bodies with `urllib.parse.parse_qs` and does not pass `max_num_fields`. A body made almost entirely of separators produces tens of millions of fields, and the parse happens on the even