{"id":"CVE-2024-52804","aliases":["ALSA-2024:10590","ALSA-2025:2872","AZL-53522","AZL-53624","BELL-CVE-2024-52804","CLSA-2026-1772496774","CLSA-2026-1774830272","CLSA-2026-1790243751","CLSA-2026-1790610952","CLSA-2026-1790611274","CLSA-2026-1792168002","DEBIAN-CVE-2024-52804","DLA-4007-1","EUVD-2024-3349","GHSA-8w49-h785-mj3c","MGASA-2025-0060","OESA-2024-2509","PYSEC-2026-1975","RHSA-2024:10590","RHSA-2024:10836","RHSA-2024:10843","RHSA-2025:2470","RHSA-2025:2471","RHSA-2025:2550","RHSA-2025:2872","RHSA-2025:2955","RHSA-2025:2956","RHSA-2025:3108","RHSA-2025:3109","RLSA-2024:10590","RLSA-2025:2471","RLSA-2025:2872","ROOT-APP-PYPI-CVE-2024-52804","SUSE-SU-2024:4137-1","SUSE-SU-2025:20096-1","SUSE-SU-2025:20445-1","UBUNTU-CVE-2024-52804","USN-7150-1","openSUSE-SU-2024:14528-1"],"status":"published","title":"Tornado has HTTP cookie parsing DoS vulnerability","description":"Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01044,"percentile":0.64381,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2024-11-22T15:43:38Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"PyPI","package":"tornado","fixed_in":["6.4.2"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:9","package":"python3-tornado","fixed_in":["6.4.2-1.el9_5"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"pcs","fixed_in":["0.10.18-2.el8_10.4.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"pcs-snmp","fixed_in":["0.10.18-2.el8_10.4.alma.1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"py3-tornado","fixed_in":["6.4.2-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"tornado","fixed_in":["5.1.1.post1+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-tornado","fixed_in":["6.2.0-3+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-tornado","fixed_in":["6.4.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-tornado","fixed_in":["6.4.2-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"python-tornado","fixed_in":["6.3.2-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"python-tornado","fixed_in":["6.1-3.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"python-tornado","fixed_in":["6.3.3-2.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"python-tornado","fixed_in":["6.1-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"python-tornado","fixed_in":["6.1-3.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"python-tornado","fixed_in":["5.0.2-9.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::highavailability","package":"pcs","fixed_in":["0:0.11.1-10.el9_0.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::highavailability","package":"pcs-snmp","fixed_in":["0:0.11.1-10.el9_0.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::resilientstorage","package":"pcs","fixed_in":["0:0.11.1-10.el9_0.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::resilientstorage","package":"pcs-snmp","fixed_in":["0:0.11.1-10.el9_0.7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs","fixed_in":["0:0.10.18-2.el8_10.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs-snmp","fixed_in":["0:0.10.18-2.el8_10.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs","fixed_in":["0:0.10.18-2.el8_10.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs-snmp","fixed_in":["0:0.10.18-2.el8_10.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::highavailability","package":"pcs","fixed_in":["0:0.10.8-1.el8_4.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::highavailability","package":"pcs-snmp","fixed_in":["0:0.10.8-1.el8_4.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::highavailability","package":"pcs","fixed_in":["0:0.10.8-1.el8_4.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::highavailability","package":"pcs-snmp","fixed_in":["0:0.10.8-1.el8_4.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::highavailability","package":"pcs","fixed_in":["0:0.10.8-1.el8_4.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::highavailability","package":"pcs-snmp","fixed_in":["0:0.10.8-1.el8_4.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::highavailability","package":"pcs","fixed_in":["0:0.10.12-6.el8_6.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::highavailability","package":"pcs-snmp","fixed_in":["0:0.10.12-6.el8_6.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::highavailability","package":"pcs","fixed_in":["0:0.10.12-6.el8_6.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::highavailability","package":"pcs-snmp","fixed_in":["0:0.10.12-6.el8_6.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::highavailability","package":"pcs","fixed_in":["0:0.10.15-4.el8_8.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::highavailability","package":"pcs-snmp","fixed_in":["0:0.10.15-4.el8_8.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::resilientstorage","package":"pcs","fixed_in":["0:0.10.15-4.el8_8.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::resilientstorage","package":"pcs-snmp","fixed_in":["0:0.10.15-4.el8_8.4"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"python-tornado","fixed_in":["0:6.4.2-1.el9_5"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"pcs","fixed_in":["0:0.11.8-1.el9_5.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"pcs","fixed_in":["0:0.10.18-2.el8_10.4"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"tornado","fixed_in":["6.2+aikido.10","6.4.1+aikido.3","6.2+aikido.2","6.3.3+aikido.3","6.2+aikido.3","6.2+aikido.4","6.2+aikido.5","6.2+aikido.6","6.2+aikido.7","6.2+aikido.8","6.3.3+aikido.4","6.4.1+aikido.4","6.2+aikido.9","6.4.1+aikido.5","6.2+aikido.11","6.3.3+aikido.5","6.2+aikido.12"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP5","package":"python-tornado6","fixed_in":["6.3.2-150400.9.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"python-tornado6","fixed_in":["6.3.2-150400.9.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"python-tornado6","fixed_in":["6.3.2-150400.9.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"python-tornado6","fixed_in":["6.3.2-150400.9.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"python-tornado6","fixed_in":["6.4-2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-tornado","fixed_in":["4.5.3-1ubuntu0.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-tornado","fixed_in":["6.0.3+really5.1.1-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-tornado","fixed_in":["6.1.0-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"python-tornado","fixed_in":["6.4.0-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"python-tornado","fixed_in":["6.4.2-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-tornado6","fixed_in":["6.4.2-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.4.1"},{"fixed":"6.4.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-1.el9_5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.18-2.el8_10.4.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.18-2.el8_10.4.alma.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.3.3-11"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.2.0-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"py3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.3-r0"},{"fixed":"6.4.2-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1"},{"fixed":"6.1.0.post1+tuxcare"}]}],"versions":["6.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.1"},{"fixed":"5.1.1.post1+tuxcare"}]}],"versions":["5.1.1"]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.18-2.el8.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.18-2.el8.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els2"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els2"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els2"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els2"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.4-7.el9_2.tuxcare.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.4-7.el9_2.tuxcare.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-3+deb12u1"}]}],"versions":["6.2.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0-1+deb11u1"}]}],"versions":["6.1.0-1"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2"}]}],"versions":["0.2","1.0","1.1","1.1.1","1.2","1.2.1","2.0","2.1","2.1.1","2.2","2.2.1","2.3","2.4","2.4.1","3.0","3.0.1","3.0.2","3.1","3.1.1","3.2","3.2.1","3.2.2","4.0","4.0.1","4.0.2","4.1","4.1b2","4.2","4.2.1","4.2b1","4.3","4.3b1","4.3b2","4.4","4.4.1","4.4.2","4.4.3","4.4b1","4.5","4.5.1","4.5.2","4.5.3","4.5b1","4.5b2","5.0","5.0.1","5.0.2","5.0a1","5.0b1","5.1","5.1.1","5.1b1","6.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0a1","6.0b1","6.1","6.1b1","6.1b2","6.2","6.2b1","6.2b2","6.3","6.3.1","6.3.2","6.3.3","6.3b1","6.4","6.4.1","6.4b1"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.3-2.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-3.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-9.oe2003sp4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2"}]}],"versions":["0.2","1.0","1.1","1.1.1","1.2","1.2.1","2.0","2.1","2.1.1","2.2","2.2.1","2.3","2.4","2.4.1","3.0","3.0.1","3.0.2","3.1","3.1.1","3.2","3.2.1","3.2.2","4.0","4.0.1","4.0.2","4.1","4.1b2","4.2","4.2.1","4.2b1","4.3","4.3b1","4.3b2","4.4","4.4.1","4.4.2","4.4.3","4.4b1","4.5","4.5.1","4.5.2","4.5.3","4.5b1","4.5b2","5.0","5.0.1","5.0.2","5.0a1","5.0b1","5.1","5.1.1","5.1b1","6.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0a1","6.0b1","6.1","6.1b1","6.1b2","6.2","6.2b1","6.2b2","6.3","6.3.1","6.3.2","6.3.3","6.3b1","6.4","6.4.1","6.4b1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.7-2.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.7-2.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.7-2.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.7-2.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.8-1.el9_5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.8-1.el9_5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.8-1.el9_5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.8-1.el9_5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.4-7.el9_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.4-7.el9_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.4-7.el9_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.4-7.el9_2.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.15-4.el8_8.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.15-4.el8_8.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.15-4.el8_8.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.15-4.el8_8.4"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_5"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.8-1.el9_5.2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10.4"}]}]},{"source":"osv","ecosystem":"Root:PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2+aikido.10"},{"fixed":"6.4.1+aikido.3"},{"fixed":"6.2+aikido.2"},{"fixed":"6.3.3+aikido.3"},{"fixed":"6.2+aikido.3"},{"fixed":"6.2+aikido.4"},{"fixed":"6.2+aikido.5"},{"fixed":"6.2+aikido.6"},{"fixed":"6.2+aikido.7"},{"fixed":"6.2+aikido.8"},{"fixed":"6.3.3+aikido.4"},{"fixed":"6.4.1+aikido.4"},{"fixed":"6.2+aikido.9"},{"fixed":"6.4.1+aikido.5"},{"fixed":"6.2+aikido.11"},{"fixed":"6.3.3+aikido.5"},{"fixed":"6.2+aikido.12"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP5","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4-2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4-slfo.1.1_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-1ubuntu0.2+esm1"}]}],"versions":["4.5.1-2.1~build2","4.5.2-1","4.5.3-1","4.5.3-1ubuntu0.1","4.5.3-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.3+really5.1.1-3ubuntu0.1~esm1"}]}],"versions":["5.1.1-4ubuntu1","5.1.1-4ubuntu5","6.0.3+really5.1.1-2","6.0.3+really5.1.1-2build1","6.0.3+really5.1.1-2build2","6.0.3+really5.1.1-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0-3ubuntu0.1~esm1"}]}],"versions":["6.1.0-1build1","6.1.0-2","6.1.0-3","6.1.0-3build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-1ubuntu0.1"}]}],"versions":["6.3.2-1","6.4.0-0ubuntu1","6.4.0-1","6.4.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-1ubuntu0.2+esm1"}]}],"versions":["4.5.1-2.1~build2","4.5.2-1","4.5.3-1","4.5.3-1ubuntu0.1","4.5.3-1ubuntu0.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.3+really5.1.1-3ubuntu0.1~esm1"}]}],"versions":["5.1.1-4ubuntu1","5.1.1-4ubuntu5","6.0.3+really5.1.1-2","6.0.3+really5.1.1-2build1","6.0.3+really5.1.1-2build2","6.0.3+really5.1.1-3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0-3ubuntu0.1~esm1"}]}],"versions":["6.1.0-1build1","6.1.0-2","6.1.0-3","6.1.0-3build1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-1ubuntu0.1"}]}],"versions":["6.3.2-1","6.4.0-0ubuntu1","6.4.0-1","6.4.0-1build1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-1.1"}]}]}],"products":[{"vendor":"tornadoweb","product":"tornado"}],"references":[{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-8w49-h785-mj3c","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","web","article","report"]},{"url":"https://github.com/tornadoweb/tornado/commit/d5ba4a1695fbf7c6a3e54313262639b198291533","tags":["x_refsource_MISC","Patch","fix","web","article"]},{"url":"https://github.com/advisories/GHSA-7pwv-g7hj-39pr","tags":["x_refsource_MISC","Not Applicable","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00000.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52804","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-8w49-h785-mj3c","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10590","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-52804","tags":["report"]},{"url":"https://bugzilla.redhat.com/2328045","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-10590.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:2872","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-2872.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-52804","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1790243751.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49761","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46727","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47287","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59830","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61770","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61771","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61772","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61919","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31958","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1790610952.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1049","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38900","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45442","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27530","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27539","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1790611274.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792168002.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52804.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-52804","tags":["advisory"]},{"url":"https://github.com/tornadoweb/tornado","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0060.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33816","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/KECEA6QVDQMKX34TWO73YYIDDQZZ476N/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2509","tags":["advisory"]},{"url":"https://pypi.org/project/tornado","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2328045","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10590.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-14029","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533918","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-14029","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-14029","tags":["advisory"]},{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-753j-mpmx-qq6g","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/tornado-before-6.4.1-http-request-smuggling-via-transfer-encoding","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-52804","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10836","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10836.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10843","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10843.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:2470","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2470.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:2471","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2471.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:2550","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2550.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2872.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:2955","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2955.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:2956","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2956.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3108","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3108.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3109","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3109.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:10590","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:2471","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:2872","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244137-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1233668","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52804","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520096-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520445-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243268","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47287","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-52804","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7150-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-28370","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KECEA6QVDQMKX34TWO73YYIDDQZZ476N/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-52804","title":"Tornado has HTTP cookie parsing DoS vulnerability","description":"Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.","status":"published","published":"2024-11-22T15:43:38.572Z","modified":"2025-11-03T22:28:40.235Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:34:03.333404Z"}],"euvd":[{"id":"EUVD-2024-3349","description":"Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.","status":"published","published":"2024-11-22T15:43:38Z","modified":"2025-11-03T22:28:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:29.890052Z"}],"ghsa":[{"id":"GHSA-8w49-h785-mj3c","title":"Tornado has an HTTP cookie parsing DoS vulnerability","description":"The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests.\n\nSee also CVE-2024-7592 for a similar vulnerability in cpython.","status":"published","published":"2024-11-22T20:26:41Z","modified":"2025-11-04T16:54:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:39:06.376137Z"}],"nvd":[{"id":"CVE-2024-52804","description":"Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.","status":"published","published":"2024-11-22T16:15:34.417Z","modified":"2026-06-17T08:07:39.533Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:10:37.996328Z"}],"osv":[{"id":"BELL-CVE-2024-52804","status":"published","published":"2024-11-27T05:59:23.670211Z","modified":"2026-01-26T09:42:42.060567Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:20.963569Z"},{"id":"CVE-2024-52804","title":"Tornado has HTTP cookie parsing DoS vulnerability","description":"Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.","status":"published","published":"2024-11-22T15:43:38.572Z","modified":"2026-10-28T02:31:01.881348769Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:44:44.032344Z"},{"id":"DEBIAN-CVE-2024-52804","description":"Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.","status":"published","published":"2024-11-22T16:15:34.417Z","modified":"2026-11-02T12:03:07.71204577Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:44.117337Z"},{"id":"GHSA-8w49-h785-mj3c","title":"Tornado has an HTTP cookie parsing DoS vulnerability","description":"The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests.\n\nSee also CVE-2024-7592 for a similar vulnerability in cpython.","status":"published","published":"2024-11-22T20:26:41Z","modified":"2026-09-10T03:50:20.413166306Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"OESA-2024-2509","title":"python-tornado security update","description":"Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived connection to each user.\r\n\r\nSecurity Fix(es):\r\n\r\nTornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.(CVE-2024-52804)","status":"published","published":"2024-12-06T11:07:59Z","modified":"2026-08-18T01:18:42.572043233Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"PYSEC-2026-1975","title":"Tornado has an HTTP cookie parsing DoS vulnerability","description":"The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests.\n\nSee also CVE-2024-7592 for a similar vulnerability in cpython.","status":"published","published":"2026-07-07T14:34:45.585102Z","modified":"2026-07-07T17:48:11.50606872Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"RHSA-2024:10590","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2024-12-02T10:11:22Z","modified":"2026-10-20T10:02:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:10836","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2024-12-06T10:02:12Z","modified":"2026-10-20T10:02:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:10843","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2024-12-07T10:02:45Z","modified":"2026-10-20T10:02:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2025:2470","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2025-03-10T10:03:12Z","modified":"2026-10-20T10:03:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:2471","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2025-03-10T10:03:12Z","modified":"2026-10-20T10:03:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:2550","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2025-03-11T10:06:21Z","modified":"2026-08-07T10:19:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:2872","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2025-03-17T10:04:18Z","modified":"2026-08-07T10:19:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:2955","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2025-03-18T10:05:36Z","modified":"2026-08-07T10:19:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:2956","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2025-03-18T10:05:37Z","modified":"2026-08-07T10:19:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:3108","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2025-03-25T10:04:54Z","modified":"2026-10-20T10:03:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:3109","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2025-03-25T10:04:54Z","modified":"2026-08-07T10:19:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RLSA-2025:2471","title":"Important: pcs security update","description":"The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.\n\nSecurity Fix(es):\n\n* python-tornado: Tornado has HTTP cookie parsing DoS vulnerability (CVE-2024-52804)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:40:21.238475Z","modified":"2025-07-29T15:00:32.416148Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:2872","title":"Important: pcs security update","description":"The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.\n\nSecurity Fix(es):\n\n* python-tornado: Tornado has HTTP cookie parsing DoS vulnerability (CVE-2024-52804)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-05-07T19:11:49.809358Z","modified":"2025-05-07T20:08:48.28448Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"ROOT-APP-PYPI-CVE-2024-52804","title":"CVE-2024-52804 in tornado - Patched by Root","description":"Root has patched CVE-2024-52804 in the tornado package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-10-12T08:34:51Z","modified":"2026-10-12T09:15:06.4005361Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"UBUNTU-CVE-2024-52804","description":"Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.","status":"published","published":"2024-11-22T16:15:00Z","modified":"2026-02-04T02:51:42.942001Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:11.182485Z"},{"id":"ALSA-2024:10590","title":"Important: python-tornado security update","description":"Tornado is a Python web framework and asynchronous networking library that provides an open source version of scalable, non-blocking web server and tools.  \n\nSecurity Fix(es):  \n\n  * python-tornado: Tornado has HTTP cookie parsing DoS vulnerability (CVE-2024-52804)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-12-02T00:00:00Z","modified":"2026-10-29T11:32:00.228657727Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2025:2872","title":"Important: pcs security update","description":"The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.  \n\nSecurity Fix(es):  \n\n  * python-tornado: Tornado has HTTP cookie parsing DoS vulnerability (CVE-2024-52804)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-03-17T00:00:00Z","modified":"2026-10-29T11:02:28.291675988Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"AZL-53522","title":"CVE-2024-52804 affecting package python-tornado 6.3.3-11","description":"Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.","status":"published","published":"2024-11-22T16:15:34Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:20.828909Z"},{"id":"AZL-53624","title":"CVE-2024-52804 affecting package python-tornado 6.2.0-1","description":"Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.","status":"published","published":"2024-11-22T16:15:34Z","modified":"2026-04-21T04:35:18.737096Z","updated_at":"2026-11-02T15:28:06.595149Z"},{"id":"CLSA-2026-1772496774","title":"TuxCare security update for tornado (2 CVEs)","description":"TuxCare rebuilt tornado to address 2 CVEs. Fixed in 6.1.0.post1+tuxcare.","status":"published","published":"2026-08-04T14:52:09Z","modified":"2026-10-15T09:48:05.138700162Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1774830272","title":"TuxCare security update for tornado (1 CVE)","description":"TuxCare rebuilt tornado to address 1 CVE. Fixed in 5.1.1.post1+tuxcare.","status":"published","published":"2026-08-04T14:52:16Z","modified":"2026-10-15T09:48:05.009185993Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1790243751","title":"pcs: Fix of 10 CVEs","description":"- CVE-2025-46727: unbounded query parsing in bundled rack; a body of repeated\n  keys was parsed in full, exhausting memory. Capped by rack's new query\n  bytesize and parameter-count limits, which pcsd turns into an HTTP 400\n- CVE-2025-59830: the same unbounded query parse reached through ';' separated\n  query strings, which rack's parameter counter did not count\n- CVE-2025-61770: multipart parsing in bundled rack read the whole request body\n  searching for a boundary that never arrived\n- CVE-2025-61771: multipart parsing in bundled rack retained an unbounded\n  non-file field in memory\n- CVE-2025-61772: multipart mime part headers in bundled rack were read with no\n  size limit\n- CVE-2025-61919: Rack::Request#POST read the entire request body before any\n  limit applied, so a 64 MB body was fully buffered\n- CVE-2024-49761: quadratic regular expression in bundled rexml\n  BaseParser#unnormalize; a long run of zeros in a hex character reference made\n  the parser hang\n- CVE-2024-52804: quadratic cookie unquoting in bundled tornado\n  _unquote_cookie, which rescanned the value from each escape\n- CVE-2025-47287: malformed multipart/form-data in bundled tornado logged a\n  warning per bad part instead of rejecting the request, flooding the log\n- CVE-2026-31958: unbounded part count and part header size in bundled tornado\n  multipart parsing\n- Stop forwarding client HTTP headers from the Tornado front end to the Ruby\n  part of pcsd, which only ever needed the cookie and the content type","status":"published","published":"2026-09-24T09:56:11Z","modified":"2026-10-26T09:43:44.481328861Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790610952","title":"pcs: Fix of 7 CVEs","description":"- CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords\n- CVE-2022-38900: fix DoS in decode() of bundled decode-uri-component\n- CVE-2022-45442: fix reflected file download in bundled sinatra attachment()\n- CVE-2023-27530: fix multipart part count DoS in rack (via rack 2.2.20)\n- CVE-2023-27539: fix ReDoS in rack header parsing (via rack 2.2.20)\n- CVE-2024-52804: fix quadratic cookie parsing in bundled tornado\n- CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado","status":"published","published":"2026-09-28T15:56:09Z","modified":"2026-10-26T09:31:44.061169655Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790611274","title":"pcs: Fix of 7 CVEs","description":"- CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords\n- CVE-2022-38900: fix DoS in decode() of bundled decode-uri-component\n- CVE-2022-45442: fix reflected file download in bundled sinatra attachment()\n- CVE-2023-27530: fix multipart part count DoS in rack (via rack 2.2.20)\n- CVE-2023-27539: fix ReDoS in rack header parsing (via rack 2.2.20)\n- CVE-2024-52804: fix quadratic cookie parsing in bundled tornado\n- CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado","status":"published","published":"2026-09-28T16:01:31Z","modified":"2026-10-26T09:31:51.368414759Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792168002","title":"pcs: Fix of 3 CVEs","description":"- CVE-2026-31958: cap multipart part count and part header size in bundled tornado, and stop accepting multipart requests in pcsd\n- CVE-2024-52804: fix quadratic cookie parsing in bundled tornado\n- CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado","status":"published","published":"2026-10-16T16:26:53Z","modified":"2026-10-26T09:43:51.563039982Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"DLA-4007-1","title":"python-tornado - security update","status":"published","published":"2025-01-01T00:00:00Z","modified":"2026-03-09T02:08:47.100525Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2025-0060","title":"Updated python-tornado packages fix security vulnerability","description":"Tornado has an HTTP cookie parsing DoS vulnerability. (CVE-2024-52804)\n","status":"published","published":"2025-02-12T21:31:42Z","modified":"2026-04-16T04:43:08.249986295Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2024:14528-1","title":"python310-tornado6-6.4.2-1.1 on GA media","description":"These are all security issues fixed in the python310-tornado6-6.4.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-11-26T00:00:00Z","modified":"2026-02-04T03:17:57.517077Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"RLSA-2024:10590","title":"Important: python-tornado security update","description":"Tornado is a Python web framework and asynchronous networking library that provides an open source version of scalable, non-blocking web server and tools.\n\nSecurity Fix(es):\n\n* python-tornado: Tornado has HTTP cookie parsing DoS vulnerability (CVE-2024-52804)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-03-17T20:16:49.937392Z","modified":"2026-02-04T07:40:20.692786Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"SUSE-SU-2024:4137-1","title":"Security update for python-tornado6","description":"This update for python-tornado6 fixes the following issues:\n\n- CVE-2024-52804: Fixed a denial of service caused by quadratic performance of cookie parsing (bsc#1233668)\n","status":"published","published":"2024-12-02T12:28:43Z","modified":"2026-02-04T03:23:59.270889Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:20096-1","title":"Security update for python-tornado6","description":"This update for python-tornado6 fixes the following issues:\n\n- CVE-2024-52804: Avoid quadratic performance of cookie parsing (bsc#1233668).\n","status":"published","published":"2025-02-03T09:13:17Z","modified":"2026-03-23T04:48:52.558011Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20445-1","title":"Security update for python-tornado6","description":"This update for python-tornado6 fixes the following issues:\n\n- CVE-2024-52804: Fixed excessive CPU consumption by the algorithm \n  used for parsing HTTP cookies (bsc#1233668)\n- CVE-2025-47287: Fixed denial-of-service via generation of an extremely\n  high volume of logs due to multipart/form-data parser (bsc#1243268)\n","status":"published","published":"2025-06-24T08:53:22Z","modified":"2026-03-23T04:48:16.542414Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"USN-7150-1","title":"python-tornado vulnerabilities","description":"It was discovered that Tornado incorrectly handled a certain redirect.\nA remote attacker could possibly use this issue to redirect a user to an\narbitrary web site and conduct a phishing attack by having the user access\na specially crafted URL. This issue was only addressed in Ubuntu 22.04 LTS,\nUbuntu 20.04 LTS, and Ubuntu 18.04 LTS. Ubuntu 16.04 LTS was previously\naddressed in USN-6159-1. (CVE-2023-28370)\n\nIt was discovered that Tornado inefficiently handled requests when parsing\ncookies. An attacker could possibly use this issue to increase resource\nutilization leading to a denial of service. (CVE-2024-52804)\n","status":"published","published":"2024-12-11T15:04:47Z","modified":"2026-04-27T17:36:25.525801Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}