p PatchFirst

CVE-2024-52804

CVE-2024-52804 · Tornado has HTTP cookie parsing DoS vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.

CVSS 7.5 · High · EPSS 1.0% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • tornado

    Versions
    • < 6.4.2: Affected

    No fix published

  • python-tornado Debian:12

    Versions
    • 6.2.0-3
    Affected ranges
    • ECOSYSTEM: < 6.2.0-3+deb12u1

    Update to 6.2.0-3+deb12u1

  • python-tornado Debian:13

    Affected ranges
    • ECOSYSTEM: < 6.4.2-1

    Update to 6.4.2-1

  • python-tornado Debian:14

    Affected ranges
    • ECOSYSTEM: < 6.4.2-1

    Update to 6.4.2-1

  • tornado PyPI

    Versions
    • 0.2
    • 1.0
    • 1.1
    • 1.1.1
    • 1.2
    • 1.2.1
    • 2.0
    • 2.1
    • 2.1.1
    • 2.2
    • 2.2.1
    • 2.3
    • 2.4
    • 2.4.1
    • 3.0
    • 3.0.1
    • 3.0.2
    • 3.1
    • 3.1.1
    • 3.2
    • 3.2.1
    • 3.2.2
    • 4.0
    • 4.0.1
    • 4.0.2
    • 4.1
    • 4.1b2
    • 4.2
    • 4.2.1
    • 4.2b1
    • 4.3
    • 4.3b1
    • 4.3b2
    • 4.4
    • 4.4.1
    • 4.4.2
    • 4.4.3
    • 4.4b1
    • 4.5
    • 4.5.1
    • 4.5.2
    • 4.5.3
    • 4.5b1
    • 4.5b2
    • 5.0
    • 5.0.1
    • 5.0.2
    • 5.0a1
    • 5.0b1
    • 5.1
    • 5.1.1
    • 5.1b1
    • 6.0
    • 6.0.1
    • 6.0.2
    • 6.0.3
    • 6.0.4
    • 6.0a1
    • 6.0b1
    • 6.1
    • 6.1b1
    • 6.1b2
    • 6.2
    • 6.2b1
    • 6.2b2
    • 6.3
    • 6.3.1
    • 6.3.2
    • 6.3.3
    • 6.3b1
    • 6.4
    • 6.4.1
    • 6.4b1
    Affected ranges
    • ECOSYSTEM: < 6.4.2

    Update to 6.4.2

  • python-tornado Ubuntu:Pro:18.04:LTS

    Versions
    • 4.5.1-2.1~build2
    • 4.5.2-1
    • 4.5.3-1
    • 4.5.3-1ubuntu0.1
    • 4.5.3-1ubuntu0.2
    Affected ranges
    • ECOSYSTEM: < 4.5.3-1ubuntu0.2+esm1

    Update to 4.5.3-1ubuntu0.2+esm1

  • python-tornado Ubuntu:Pro:20.04:LTS

    Versions
    • 5.1.1-4ubuntu1
    • 5.1.1-4ubuntu5
    • 6.0.3+really5.1.1-2
    • 6.0.3+really5.1.1-2build1
    • 6.0.3+really5.1.1-2build2
    • 6.0.3+really5.1.1-3
    Affected ranges
    • ECOSYSTEM: < 6.0.3+really5.1.1-3ubuntu0.1~esm1

    Update to 6.0.3+really5.1.1-3ubuntu0.1~esm1

  • python-tornado Ubuntu:Pro:22.04:LTS

    Versions
    • 6.1.0-1build1
    • 6.1.0-2
    • 6.1.0-3
    • 6.1.0-3build1
    Affected ranges
    • ECOSYSTEM: < 6.1.0-3ubuntu0.1~esm1

    Update to 6.1.0-3ubuntu0.1~esm1

  • python-tornado Ubuntu:24.04:LTS

    Versions
    • 6.3.2-1
    • 6.4.0-0ubuntu1
    • 6.4.0-1
    • 6.4.0-1build1
    Affected ranges
    • ECOSYSTEM: < 6.4.0-1ubuntu0.1

    Update to 6.4.0-1ubuntu0.1

  • python-tornado Ubuntu:25.10

    Affected ranges
    • ECOSYSTEM: < 6.4.2-1

    Update to 6.4.2-1

Original sources

Check your server →