| Package | Affected versions | Patched versions |
|---|---|---|
| tornado | < 6.5.5 | 6.5.5 |
| tornado | < 6.5.5 | 6.5.5 |
In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts.
Tornado 6.5.5 introduces new limits on the size and complexity of multipart bodies, including a default limit of 100 parts per request. These limits are configurable if needed; see tornado.httputil.ParseMultipartConfig. It is also now possible to disable multipart/form-data parsing entirely if it is not required for the application.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free