Most recent entries from all

ALSA-2024:10590 — Important: python-tornado security update

Affected: AlmaLinux:9: python3-tornado

Tornado is a Python web framework and asynchronous networking library that provides an open source version of scalable, non-blocking web server and tools.

Security Fix(es):

* python-tornado: Tornado has HTTP cookie parsing DoS vulnerability (CVE-2024-52804)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-00918

BELL-CVE-2024-52804

Affected: Alpaquita:stream: py3-tornado

BREW-jupyterlab-CVE-2024-52804 — Tornado has an HTTP cookie parsing DoS vulnerability

Affected: Homebrew: jupyterlab

The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests.

See also CVE-2024-7592 for a similar vulnerability in cpython.

certfr-2025-avi-0303 — De multiples vulnérabilités ont été découvertes dans les produits Splunk. Elles permettent à un attaquant de provoquer…

certfr-2025-avi-0303

EUVD-2026-258707

fkie_cve-2024-52804

Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.

GHSA-8w49-h785-mj3c — Tornado has an HTTP cookie parsing DoS vulnerability

Affected: PyPI: tornado

See also CVE-2024-7592 for a similar vulnerability in cpython.

OESA-2024-2509 — python-tornado security update

Affected: openEuler:22.03-LTS-SP1: python-tornado, openEuler:24.03-LTS: python-tornado, openEuler:22.03-LTS-SP4: python-tornado, openEuler:22.03-LTS-SP3: python-tornado, openEuler:20.03-LTS-SP4: python-tornado

Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived connection to each user. Security Fix(es): Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.(CVE-2024-52804)

openSUSE-SU-2024:14528-1 — python310-tornado6-6.4.2-1.1 on GA media

python310-tornado6-6.4.2-1.1 on GA media

PYSEC-2026-1975 — Tornado has an HTTP cookie parsing DoS vulnerability

Affected: PyPI: tornado

See also CVE-2024-7592 for a similar vulnerability in cpython.

RHSA-2024:10836 — Red Hat Security Advisory: python-tornado security update

python-tornado: Tornado has HTTP cookie parsing DoS vulnerability

SUSE-SU-2024:4137-1 — Security update for python-tornado6

Security update for python-tornado6

UBUNTU-CVE-2024-52804

Affected: Ubuntu:Pro:18.04:LTS: python-tornado, Ubuntu:Pro:20.04:LTS: python-tornado, Ubuntu:Pro:22.04:LTS: python-tornado, Ubuntu:24.04:LTS: python-tornado, Ubuntu:25.10: python-tornado

WID-SEC-W-2024-3569 — Red Hat Enterprise Linux (python-tornado): Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.