PT-2024-10401 · Tornado+9 · Tornado+9
Kexinoh
·
Published
2024-11-22
·
Updated
2026-06-03
·
CVE-2024-52804
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Tornado versions prior to 6.4.2
Description
The algorithm used for parsing HTTP cookies in Tornado sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests, potentially allowing a remote attacker to cause a denial of service.
Recommendations
For versions prior to 6.4.2, update to version 6.4.2 to fix the issue. As a temporary workaround, consider restricting the size of HTTP cookie headers to minimize the risk of exploitation.
Exploit
Fix
DoS
Resource Exhaustion
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Tornado
Ubuntu