CVE-2024-52804 - CVE House
Back to Database
Status published High CVE-2024-52804

Tornado has HTTP cookie parsing DoS vulnerability

Vulnerability Description

Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-52804

Credits & Attribution

No credits recorded in the NVD database.

References

More from tornadoweb

View All →
CVE-2025-67726
Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters
High 7.5
CVE-2025-67725
Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing
High 7.5
CVE-2025-67724
Tornado vulnerable to Header Injection and XSS via reason argument
Medium 5.4
CVE-2025-47287
Tornado vulnerable to excessive logging caused by malformed multipart form data
High 7.5
CVE-2023-28370
Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows...
Unknown 0

Affected Vendor

Affected Software

tornado
Vulnerable Versions:
< 6.4.2

Timeline

Official Publish: November 22nd, 2024
Last Modified: November 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-400 CWE-770

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1562 Impair Defenses
Defense Evasion
T1046 Network Service Discovery
Discovery