High · published December 12, 2025
⚡ A single malicious request can bring your entire Tornado server to its knees! This DoS vulnerability in versions 6.5.2 and below turns a small trickle of data into a monstrous CPU-crushing flood. 🔥 Think of it like a traffic jam caused by a single car parked in the middle of a busy intersection. Just as that one obstruction can halt all movement, this flawed parsing algorithm can cause your server to freeze up under the weight of just one badly crafted request. An attacker can craft a Content-Disposition header filled with malicious parameters that exponentially increase CPU usage, leading to unresponsiveness. In a world where every second counts, this can be absolutely devastating for your users and your service availability, leaving you helpless while your site is down.
Think of it like a traffic jam caused by a single car parked in the middle of a busy intersection. Just as that one obstruction can halt all movement, this flawed parsing algorithm can cause your server to freeze up under the weight of just one badly crafted request. The inefficiency lies in the _parseparam function in httputil.py, which uses string.count() in nested loops, leading to quadratic time performance (O(n²)) when processing certain HTTP header values. This means that even a single request can monopolize your server's processing power, crippling its performance.
An attacker can craft a Content-Disposition header filled with malicious parameters that exponentially increase CPU usage, leading to unresponsiveness. In a world where every second counts, this can be absolutely devastating for your users and your service availability, leaving you helpless while your site is down. Upgrade Tornado to version 6.5.3 immediately to eliminate this vulnerability. Regularly monitor your server's performance and consider implementing rate limiting to help mitigate similar threats in the future. 🚨 You've got this! By taking swift action, you're well on your way to securing your server and maintaining user trust. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| tornadoweb/tornado | < 6.5.3 | 6.5.3 |