PYSEC-2026-1975
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/tornado/PYSEC-2026-1975.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-1975
- Aliases
- Published
- 2026-07-07T14:34:45.585102Z
- Modified
- 2026-07-07T17:48:11.506068720Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Tornado has an HTTP cookie parsing DoS vulnerability
- Details
-
The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests.
See also CVE-2024-7592 for a similar vulnerability in cpython.
- References
-
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-8w49-h785-mj3c
- https://nvd.nist.gov/vuln/detail/CVE-2024-52804
- https://github.com/tornadoweb/tornado/commit/d5ba4a1695fbf7c6a3e54313262639b198291533
- https://github.com/tornadoweb/tornado
- https://lists.debian.org/debian-lts-announce/2025/01/msg00000.html
- https://pypi.org/project/tornado
- https://github.com/advisories/GHSA-8w49-h785-mj3c
Affected packages
PyPI / tornado
Package
- Name
- tornado
- View open source insights on deps.dev
- Purl
- pkg:pypi/tornado
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed6.4.2
Affected versions
0.*
0.2
1.*
1.0
1.1
1.1.1
1.2
1.2.1
2.*
2.0
2.1
2.1.1
2.2
2.2.1
2.3
2.4
2.4.1
3.*
3.0
3.0.1
3.0.2
3.1
3.1.1
3.2
3.2.1
3.2.2
4.*
4.0
4.0.1
4.0.2
4.1b2
4.1
4.2b1
4.2
4.2.1
4.3b1
4.3b2
4.3
4.4b1
4.4
4.4.1
4.4.2
4.4.3
4.5b1
4.5b2
4.5
4.5.1
4.5.2
4.5.3
5.*
5.0a1
5.0b1
5.0
5.0.1
5.0.2
5.1b1
5.1
5.1.1
6.*
6.0a1
6.0b1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.1b1
6.1b2
6.1
6.2b1
6.2b2
6.2
6.3b1
6.3
6.3.1
6.3.2
6.3.3
6.4b1
6.4
6.4.1