CVE-2024-52804

Katalog CVE

CVSS 7.5 · High EPSS 1,0%

Kerentanan Uncontrolled Resource Consumption pada tornadoweb tornado. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.

Rincian

Terbit di NVD

22 November 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 63,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tornadoweb/tornado/commit/d5ba4a1695fbf7c6a3e54313262639b198291533 patch
• https://github.com/tornadoweb/tornado/security/advisories/GHSA-8w49-h785-mj3c advisory pihak ketiga
• https://github.com/advisories/GHSA-7pwv-g7hj-39pr not applicable
• https://lists.debian.org/debian-lts-announce/2025/01/msg00000.html