Vulnerability Description
Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tornadoweb | Tornado | < 6.4.2 |
Related Weaknesses (CWE)
References
- https://github.com/advisories/GHSA-7pwv-g7hj-39prNot Applicable
- https://github.com/tornadoweb/tornado/commit/d5ba4a1695fbf7c6a3e54313262639b1982Patch
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-8w49-h785-mj3cThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2025/01/msg00000.html
FAQ
What is CVE-2024-52804?
CVE-2024-52804 is a vulnerability with a CVSS score of 7.5 (HIGH). Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to exc...
How severe is CVE-2024-52804?
CVE-2024-52804 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-52804?
Check the references section above for vendor advisories and patch information. Affected products include: Tornadoweb Tornado.