High severityNVD Advisory· Published Nov 22, 2024· Updated Nov 3, 2025
Tornado has HTTP cookie parsing DoS vulnerability
CVE-2024-52804
Description
Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
tornadoPyPI | < 6.4.2 | 6.4.2 |
Affected products
36- osv-coords35 versionspkg:apk/chainguard/airflowpkg:apk/chainguard/airflow-bitnami-compatpkg:apk/chainguard/airflow-compatpkg:apk/chainguard/dask-gatewaypkg:apk/chainguard/dask-gateway-serverpkg:apk/chainguard/kubeflow-pipelines-visualization-serverpkg:apk/chainguard/py3.10-tornadopkg:apk/chainguard/py3.11-tornadopkg:apk/chainguard/py3.12-tornadopkg:apk/chainguard/py3.13-tornadopkg:apk/chainguard/py3-supported-tornadopkg:apk/chainguard/py3-tornadopkg:apk/wolfi/airflowpkg:apk/wolfi/airflow-bitnami-compatpkg:apk/wolfi/airflow-compatpkg:apk/wolfi/dask-gatewaypkg:apk/wolfi/dask-gateway-serverpkg:apk/wolfi/kubeflow-pipelines-visualization-serverpkg:apk/wolfi/py3.10-tornadopkg:apk/wolfi/py3.11-tornadopkg:apk/wolfi/py3.12-tornadopkg:apk/wolfi/py3.13-tornadopkg:apk/wolfi/py3-supported-tornadopkg:apk/wolfi/py3-tornadopkg:pypi/tornadopkg:rpm/almalinux/pcspkg:rpm/almalinux/pcs-snmppkg:rpm/almalinux/python3-tornadopkg:rpm/opensuse/python-tornado6&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/python-tornado6&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/python-tornado6&distro=openSUSE%20Tumbleweedpkg:rpm/suse/python-tornado6&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Python%203%2015%20SP5pkg:rpm/suse/python-tornado6&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Python%203%2015%20SP6pkg:rpm/suse/python-tornado6&distro=SUSE%20Linux%20Micro%206.0pkg:rpm/suse/python-tornado6&distro=SUSE%20Linux%20Micro%206.1
< 2.10.3-r2+ 34 more
- (no CPE)range: < 2.10.3-r2
- (no CPE)range: < 2.10.3-r2
- (no CPE)range: < 2.10.3-r2
- (no CPE)range: < 2024.1.0-r12
- (no CPE)range: < 2024.1.0-r12
- (no CPE)range: < 2.3.0-r4
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 2.10.3-r2
- (no CPE)range: < 2.10.3-r2
- (no CPE)range: < 2.10.3-r2
- (no CPE)range: < 2024.1.0-r12
- (no CPE)range: < 2024.1.0-r12
- (no CPE)range: < 2.3.0-r4
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 6.4.2-r0
- (no CPE)range: < 6.4.2
- (no CPE)range: < 0.10.18-2.el8_10.4.alma.1
- (no CPE)range: < 0.10.18-2.el8_10.4.alma.1
- (no CPE)range: < 6.4.2-1.el9_5
- (no CPE)range: < 6.3.2-150400.9.6.1
- (no CPE)range: < 6.3.2-150400.9.6.1
- (no CPE)range: < 6.4.2-1.1
- (no CPE)range: < 6.3.2-150400.9.6.1
- (no CPE)range: < 6.3.2-150400.9.6.1
- (no CPE)range: < 6.4-2.1
- (no CPE)range: < 6.4-slfo.1.1_2.1
- Range: < 6.4.2
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-8w49-h785-mj3cghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-52804ghsaADVISORY
- github.com/advisories/GHSA-7pwv-g7hj-39prmitrex_refsource_MISC
- github.com/tornadoweb/tornado/commit/d5ba4a1695fbf7c6a3e54313262639b198291533ghsax_refsource_MISCWEB
- github.com/tornadoweb/tornado/security/advisories/GHSA-8w49-h785-mj3cghsax_refsource_CONFIRMWEB
- lists.debian.org/debian-lts-announce/2025/01/msg00000.htmlghsaWEB
News mentions
0No linked articles in our index yet.