Vulnerability	Vulnerable Version
H Allocation of Resources Without Limits or Throttling tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `multipart/form-data` parser. An attacker can generate an extremely high volume of logs, leading to a denial of service by sending malformed multipart form data that triggers continuous error logging. Note: This is only exploitable if the logging subsystem is synchronous. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `tornado` to version 6.5 or higher.	[,6.5)

Allocation of Resources Without Limits or Throttling

tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the multipart/form-data parser. An attacker can generate an extremely high volume of logs, leading to a denial of service by sending malformed multipart form data that triggers continuous error logging.

Note:

This is only exploitable if the logging subsystem is synchronous.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade tornado to version 6.5 or higher.

[,6.5)

Go back to all versions of this package