High severity7.5NVD Advisory· Published Nov 22, 2024· Updated Jun 17, 2026
CVE-2024-52804
CVE-2024-52804
Description
Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
tornadoPyPI | < 6.4.2 | 6.4.2 |
Affected products
37cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:*range: <6.4.2
- (no CPE)range: < 6.4.2
- osv-coords35 versionspkg:apk/chainguard/airflowpkg:apk/chainguard/airflow-bitnami-compatpkg:apk/chainguard/airflow-compatpkg:apk/chainguard/dask-gatewaypkg:apk/chainguard/dask-gateway-serverpkg:apk/chainguard/kubeflow-pipelines-visualization-serverpkg:apk/chainguard/py3-supported-tornadopkg:apk/chainguard/py3-tornadopkg:apk/chainguard/py3.10-tornadopkg:apk/chainguard/py3.11-tornadopkg:apk/chainguard/py3.12-tornadopkg:apk/chainguard/py3.13-tornadopkg:apk/wolfi/airflowpkg:apk/wolfi/airflow-bitnami-compatpkg:apk/wolfi/airflow-compatpkg:apk/wolfi/dask-gatewaypkg:apk/wolfi/dask-gateway-serverpkg:apk/wolfi/kubeflow-pipelines-visualization-serverpkg:apk/wolfi/py3-supported-tornadopkg:apk/wolfi/py3-tornadopkg:apk/wolfi/py3.10-tornadopkg:apk/wolfi/py3.11-tornadopkg:apk/wolfi/py3.12-tornadopkg:apk/wolfi/py3.13-tornadopkg:pypi/tornadopkg:rpm/almalinux/pcspkg:rpm/almalinux/pcs-snmppkg:rpm/almalinux/python3-tornadopkg:rpm/opensuse/python-tornado6&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/python-tornado6&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/python-tornado6&distro=openSUSE%20Tumbleweedpkg:rpm/suse/python-tornado6&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Python%203%2015%20SP5pkg:rpm/suse/python-tornado6&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Python%203%2015%20SP6pkg:rpm/suse/python-tornado6&distro=SUSE%20Linux%20Micro%206.0pkg:rpm/suse/python-tornado6&distro=SUSE%20Linux%20Micro%206.1
< 2.10.3-r2+ 34 more
- (no CPE)range: < 2.10.3-r2
- (no CPE)range: < 2.10.3-r2
- (no CPE)range: < 2.10.3-r2
- (no CPE)range: < 2024.1.0-r12
- (no CPE)range: < 2024.1.0-r12
- (no CPE)range: < 2.3.0-r4
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 2.10.3-r2
- (no CPE)range: < 2.10.3-r2
- (no CPE)range: < 2.10.3-r2
- (no CPE)range: < 2024.1.0-r12
- (no CPE)range: < 2024.1.0-r12
- (no CPE)range: < 2.3.0-r4
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 6.4.2
- (no CPE)range: < 0.10.18-2.el8_10.4.alma.1
- (no CPE)range: < 0.10.18-2.el8_10.4.alma.1
- (no CPE)range: < 6.4.2-1.el9_5
- (no CPE)range: < 6.3.2-150400.9.6.1
- (no CPE)range: < 6.3.2-150400.9.6.1
- (no CPE)range: < 6.4.2-1.1
- (no CPE)range: < 6.3.2-150400.9.6.1
- (no CPE)range: < 6.3.2-150400.9.6.1
- (no CPE)range: < 6.4-2.1
- (no CPE)range: < 6.4-slfo.1.1_2.1
Patches
Vulnerability mechanics
References
6- github.com/tornadoweb/tornado/commit/d5ba4a1695fbf7c6a3e54313262639b198291533nvdPatchWEB
- github.com/advisories/GHSA-8w49-h785-mj3cghsaADVISORY
- github.com/tornadoweb/tornado/security/advisories/GHSA-8w49-h785-mj3cnvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2024-52804ghsaADVISORY
- github.com/advisories/GHSA-7pwv-g7hj-39prnvdNot Applicable
- lists.debian.org/debian-lts-announce/2025/01/msg00000.htmlnvdWEB
News mentions
0No linked articles in our index yet.