High severity · published Nov 22, 2024
CVE-2024-52804
Tornado is a Python web framework and asynchronous networking library
7.5
CVSS
1%
EPSS
No
On KEV
Description
Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
Tornado · Tornadoweb
before 6.4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-52804
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-52804
Not Applicable
https://github.com/advisories/GHSA-7pwv-g7hj-39pr
Patch
https://github.com/tornadoweb/tornado/commit/d5ba4a1695fbf7c6a3e54313262639b198291533
Third Party Advisory
https://github.com/tornadoweb/tornado/security/advisories/GHSA-8w49-h785-mj3c
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/01/msg00000.html
More from Tornado
7.7
CVE-2026-49853
Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
7.5
CVE-2026-103262
Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient
7.5
CVE-2026-91990
Tornado before 6.5.8 Memory Amplification DoS via multipart
7.5
CVE-2024-14029
Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
7.5
CVE-2023-54397
Tornado before 6.3.3 HTTP Request Smuggling via Content-Length