High · published December 12, 2025
⚡ A single malicious HTTP request can send your Tornado server into a tailspin! This Denial of Service (DoS) vulnerability can keep your event loop busy for an eternity if you’re running versions 6.5.2 or below. 🔥 Think of it like a restaurant with a chef who can only prepare one dish at a time. If a customer keeps requesting variations of the same meal, the chef gets overwhelmed and can’t serve anyone else — a recipe for a hungry queue! An attacker can exploit this flaw to monopolize server resources, rendering your application unresponsive. Imagine your web service as a bustling diner that suddenly closes its doors to everyone while it deals with a non-stop order of the same dish! This could lead to significant downtime and frustrated users.
Think of it like a restaurant with a chef who can only prepare one dish at a time. If a customer keeps requesting variations of the same meal, the chef gets overwhelmed and can’t serve anyone else — a recipe for a hungry queue! The issue lies in the HTTPHeaders.add method, where repeated header names cause performance degradation due to Python's string immutability and inefficient string concatenation, resulting in O(n²) time complexity.
An attacker can exploit this flaw to monopolize server resources, rendering your application unresponsive. Imagine your web service as a bustling diner that suddenly closes its doors to everyone while it deals with a non-stop order of the same dish! This could lead to significant downtime and frustrated users. Update your Tornado framework to version 6.5.3 or higher immediately. If you can, consider setting a maximum header size limit to mitigate potential impacts until the upgrade is complete. You've got this! Patch your Tornado server and keep your web application running smoothly! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| tornadoweb/tornado | < 6.5.3 | 6.5.3 |