CVE-2024-52804 Tornado has HTTP cookie parsing DoS vulnerability
Attackers can cause excessive CPU consumption and block request processing by sending maliciously crafted HTTP cookie headers to applications using the Tornado library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-52804?
CVE-2024-52804 is a high-severity denial of service vulnerability in tornadoweb tornado, published on 22 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.
Which versions are affected by CVE-2024-52804?
3 open source packages ship an affected version, including tornado. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tornado PyPI | All versions | 6.4.2 |
tornado PyPI | All versions | 6.4.2 |
tornado PyPI | All versions | 6.4.2 |
Linux distribution packages (34)
pcs AlmaLinux:8 | All versions | 0.10.18-2.el8_10.4.alma.1 |
pcs-snmp AlmaLinux:8 | All versions | 0.10.18-2.el8_10.4.alma.1 |
python3-tornado AlmaLinux:9 | All versions | 6.4.2-1.el9_5 |
pcs Red Hat:enterprise_linux:8::highavailability | All versions | 0:0.10.18-2.el8_10.4 |
pcs-snmp Red Hat:enterprise_linux:8::highavailability | All versions | 0:0.10.18-2.el8_10.4 |
pcs Red Hat:enterprise_linux:8::resilientstorage | All versions | 0:0.10.18-2.el8_10.4 |
pcs-snmp Red Hat:enterprise_linux:8::resilientstorage | All versions | 0:0.10.18-2.el8_10.4 |
pcs Red Hat:rhel_aus:8.4::highavailability | All versions | 0:0.10.8-1.el8_4.6 |
pcs-snmp Red Hat:rhel_aus:8.4::highavailability | All versions | 0:0.10.8-1.el8_4.6 |
pcs Red Hat:rhel_e4s:8.4::highavailability | All versions | 0:0.10.8-1.el8_4.6 |
pcs-snmp Red Hat:rhel_e4s:8.4::highavailability | All versions | 0:0.10.8-1.el8_4.6 |
pcs Red Hat:rhel_e4s:8.6::highavailability | All versions | 0:0.10.12-6.el8_6.7 |
pcs-snmp Red Hat:rhel_e4s:8.6::highavailability | All versions | 0:0.10.12-6.el8_6.7 |
pcs Red Hat:rhel_e4s:9.0::highavailability | All versions | 0:0.11.1-10.el9_0.7 |
pcs-snmp Red Hat:rhel_e4s:9.0::highavailability | All versions | 0:0.11.1-10.el9_0.7 |
pcs Red Hat:rhel_e4s:9.0::resilientstorage | All versions | 0:0.11.1-10.el9_0.7 |
pcs-snmp Red Hat:rhel_e4s:9.0::resilientstorage | All versions | 0:0.11.1-10.el9_0.7 |
pcs Red Hat:rhel_eus:8.8::highavailability | All versions | 0:0.10.15-4.el8_8.4 |
pcs-snmp Red Hat:rhel_eus:8.8::highavailability | All versions | 0:0.10.15-4.el8_8.4 |
pcs Red Hat:rhel_eus:8.8::resilientstorage | All versions | 0:0.10.15-4.el8_8.4 |
pcs-snmp Red Hat:rhel_eus:8.8::resilientstorage | All versions | 0:0.10.15-4.el8_8.4 |
pcs Red Hat:rhel_tus:8.4::highavailability | All versions | 0:0.10.8-1.el8_4.6 |
pcs-snmp Red Hat:rhel_tus:8.4::highavailability | All versions | 0:0.10.8-1.el8_4.6 |
pcs Red Hat:rhel_tus:8.6::highavailability | All versions | 0:0.10.12-6.el8_6.7 |
pcs-snmp Red Hat:rhel_tus:8.6::highavailability | All versions | 0:0.10.12-6.el8_6.7 |
pcs Rocky Linux:8 | All versions | 0:0.10.18-2.el8_10.4 |
pcs Rocky Linux:9 | All versions | 0:0.11.8-1.el9_5.2 |
python-tornado Rocky Linux:9 | All versions | 0:6.4.2-1.el9_5 |
python-tornado6 SUSE:Linux Enterprise Module for Python 3 15 SP5 | All versions | 6.3.2-150400.9.6.1 |
python-tornado6 SUSE:Linux Enterprise Module for Python 3 15 SP6 | All versions | 6.3.2-150400.9.6.1 |
python-tornado6 SUSE:Linux Micro 6.0 | All versions | 6.4-2.1 |
python-tornado6 openSUSE:Leap 15.5 | All versions | 6.3.2-150400.9.6.1 |
python-tornado6 openSUSE:Leap 15.6 | All versions | 6.3.2-150400.9.6.1 |
python-tornado6 openSUSE:Tumbleweed | All versions | 6.4.2-1.1 |
Products include Tornadoweb Tornado.
How do I fix CVE-2024-52804?
Upgrade tornado to 6.4.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-52804 being exploited?
There is no known exploitation of CVE-2024-52804 in the wild and no public exploit code.
Other vulnerabilities in tornadoweb tornado
- CVE-2026-31958 Tornado has a DoS due to too many multipart parts
- CVE-2025-67725 Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing
- CVE-2025-67726 Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters
- CVE-2026-35536 Tornado has incomplete validation of cookie attributes
- CVE-2014-9720 Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)
Sources
Also known as ALSA-2024:10590, ALSA-2025:2872, AZL-53522, AZL-53624, BELL-CVE-2024-52804, CLEANSTART-2026-SW42898 and 20 more.