CVE-2024-52804CWE-400CWE-770

Tornado has HTTP cookie parsing DoS vulnerability

High · published November 22, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
63.8
In the wild
Unconfirmed
What it is

Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01044 · 63.8th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2024-11-22T15:43Z
EPSS history
Timeline
  • 22 NOV 15:43Z
    Tornado has HTTP cookie parsing DoS vulnerability
    cvelistv5