Improper resource allocation In python-tornado
Description
A denial of service flaw has been discovered in the Tornado networking library. In Tornado, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same header name is repeated, causing a Denial of Service (DoS). Due to Python string immutability, each concatenation copies the entire string, resulting in O(n²) time complexity.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 14 | 6.5.4-0.1 | ||
debian 12 | 6.2.0-3+deb12u4 | ||
debian 11 | 6.1.0-1+deb11u3 | ||
debian 13 | 6.4.2-3+deb13u2 | ||
 rpm rhel9 | - | - | |
rpm rhel9 | - | - | |
rpm rhel8 | 0:0.10.18-2.el8_10.8 | ||
rpm rhel8.4 | 0:0.10.8-1.el8_4.10 | ||
rpm rhel10 | - | - | |
rpm rhel9 | - | - |
1-10 of 11
10
Aliases
1. 2. 3. 4. 5.