CVE-2024-52804: Tornado has HTTP cookie parsing DoS vulnerability
Last updated 11 December 2024
Other sources
The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests.
See also CVE-2024-7592 for a similar vulnerability in cpython.
— GitHub
Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52804?
CVE-2024-52804 has a high severity due to potential denial-of-service caused by excessive CPU consumption.
How do I fix CVE-2024-52804?
To fix CVE-2024-52804, upgrade Tornado to version 6.4.2 or later.
Which versions of Tornado are affected by CVE-2024-52804?
Tornado versions prior to 6.4.2 are affected by CVE-2024-52804.
What type of vulnerability is CVE-2024-52804?
CVE-2024-52804 is a denial-of-service vulnerability related to inefficient parsing of HTTP cookies.
In which environments is CVE-2024-52804 a concern?
CVE-2024-52804 is a concern for applications utilizing Tornado as their web framework that process HTTP cookies.