Tornado has an HTTP cookie parsing DoS vulnerability

高 7.5CVE-2024-52804 · GHSA-8w49-h785-mj3c · PYSEC-2026-1975 · 22/11/2024 公開 · 17/06/2026 更新

要点

CVE-2024-52804 は tornado, tornado (tornadoweb) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.0%（全脆弱性の 64.2% より高い）。
対処：6.4.2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
tornado PyPI	`< 6.4.2`	`6.4.2`
tornado tornadoweb	`< 6.4.2`	`6.4.2`

概要

The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests.

See also CVE-2024-7592 for a similar vulnerability in cpython.

NVD の説明

Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.