CVE-2024-52804·Python vulnerability

Affected versions

How to fix this CVE

Update Python's Tornado web framework to version 6.4.2 or later to remediate a cookie parsing vulnerability that causes excessive CPU consumption. This vulnerability allows unauthenticated attackers to trigger denial-of-service conditions by sending specially crafted HTTP cookie headers that trigger quadratic-time parsing logic. Ensure all systems running Tornado are patched immediately, particularly those exposed to untrusted network traffic.

sudo dnf update python3-tornado

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET .* HTTP/1\.[01].*Cookie:.{1000,}|Cookie:.*(?:[a-zA-Z0-9_-]{50,}=){5,}

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement request-level cookie header size validation: reject HTTP requests with Cookie headers exceeding 4096 bytes. Add rate limiting on the Tornado application level to detect clients sending repeated requests with unusually large or complex cookie structures within short time windows.

How to check if you are affected

1. Check installed Tornado version: python3 -c "import tornado; print(tornado.version)" and verify it is 6.4.2 or higher
2. Identify Tornado applications in your environment: grep -r "import tornado" /opt /srv /home --include="*.py" 2>/dev/null | grep -v __pycache__
3. Review web server access logs for abnormal cookie header sizes or repeated malformed cookie patterns: grep -i 'cookie' /var/log/nginx/access.log | awk -F'Cookie:' '{print $2}' | awk '{print length}' | sort -rn | head -20
4. Verify the patch was applied by checking Tornado version again and confirming pip list shows tornado>=6.4.2 for Python package managers

FAQ

Related Python CVEs

References

• https://github.com/advisories/GHSA-7pwv-g7hj-39pr
• https://github.com/tornadoweb/tornado/commit/d5ba4a1695fbf7c6a3e54313262639b198291533
• https://github.com/tornadoweb/tornado/security/advisories/GHSA-8w49-h785-mj3c
• https://lists.debian.org/debian-lts-announce/2025/01/msg00000.html