Skip to content
OpenAdvisories
High · 7.5 CVE-2024-52804 EUVD-2024-3349GHSA-8w49-h785-mj3cPYSEC-2026-1975

Tornado has HTTP cookie parsing DoS vulnerability

Published Nov 22, 2024 · Updated Nov 3, 2025 · Assigned by GitHub_M

Vendor: tornadoweb Product: tornado Package: airflow Package: dask-gateway Package: dask-gateway-server Package: kubeflow-pipelines-visualization-server Package: py3-tornado Package: python-tornado Package: python-tornado Package: python-tornado Package: tornado Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: PyPI Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.

Affected products

VendorProductAffectedFixed
tornadoweb tornado < 6.4.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 python-tornado 6.4.2-1 —
Debian 13 python-tornado 6.4.2-1 —
Debian 12 python-tornado 6.2.0-3+deb12u1 —
Debian 11 python-tornado 6.1.0-1+deb11u1 DLA-4007-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 python-tornado 6.4.2-1 —
Ubuntu 24.04 LTS python-tornado 6.4.0-1ubuntu0.1 USN-7150-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS python-tornado 6.1.0-3ubuntu0.1~esm1 USN-7150-1
Ubuntu Pro 20.04 LTS python-tornado 6.0.3+really5.1.1-3ubuntu0.1~esm1 USN-7150-1
Ubuntu Pro 18.04 LTS python-tornado 4.5.3-1ubuntu0.2+esm1 USN-7150-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 pcs +1 0.11.8-1.el9_5.2 RHSA-2025:2471
RHEL 9 python-tornado +1 6.4.2-1.el9_5 RHSA-2024:10590
RHEL 8 pcs +1 0.10.18-2.el8_10.4 RHSA-2025:2872
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.4 EUS pcs +1 0.11.7-2.el9_4.3 RHSA-2025:2470
RHEL 9.4 EUS python-tornado +1 6.4.2-1.el9_4 RHSA-2024:10843
RHEL 9.2 EUS pcs +1 0.11.4-7.el9_2.4 RHSA-2025:3108
RHEL 9.2 EUS python-tornado +1 6.4.2-1.el9_2 RHSA-2024:10836
RHEL 9.0 E4S pcs +1 0.11.1-10.el9_0.7 RHSA-2025:2550
RHEL 8.8 EUS pcs +1 0.10.15-4.el8_8.4 RHSA-2025:3109
RHEL 8.6 TUS pcs +1 0.10.12-6.el8_6.7 RHSA-2025:2956
RHEL 8.6 E4S pcs +1 0.10.12-6.el8_6.7 RHSA-2025:2956
RHEL 8.4 TUS pcs +1 0.10.8-1.el8_4.6 RHSA-2025:2955
RHEL 8.4 E4S pcs +1 0.10.8-1.el8_4.6 RHSA-2025:2955
RHEL 8.4 AUS pcs +1 0.10.8-1.el8_4.6 RHSA-2025:2955

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 python3-tornado 6.4.2-1.el9_5 ALSA-2024:10590
AlmaLinux 8 pcs +1 0.10.18-2.el8_10.4.alma.1 ALSA-2025:2872

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 pcs 0.11.8-1.el9_5.2 RLSA-2025:2471
Rocky Linux 9 python-tornado 6.4.2-1.el9_5 RLSA-2024:10590
Rocky Linux 8 pcs 0.10.18-2.el8_10.4 RLSA-2025:2872

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 3 python-tornado6 6.3.2-150400.9.6.1 SUSE-SU-2024:4137-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 6.1 python-tornado6 6.4-slfo.1.1_2.1 SUSE-SU-2025:20445-1
SLE Micro 6.0 python-tornado6 6.4-2.1 SUSE-SU-2025:20096-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python-tornado6 6.4.2-1.1 openSUSE-SU-2024:14528-1
openSUSE Leap 15.6 python-tornado6 6.3.2-150400.9.6.1 SUSE-SU-2024:4137-1
openSUSE Leap 15.5 python-tornado6 6.3.2-150400.9.6.1 SUSE-SU-2024:4137-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 python3-tornado +1 6.1.0-2.amzn2023.0.4 ALAS2023-2025-792
Amazon Linux 2 python3-tornado +1 5.0.2-4.amzn2.0.4 ALAS2-2025-2725

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python-tornado No fix yet —
Azure Linux 2 (CBL-Mariner) python-tornado No fix yet —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 pcs +1 0.11.8-1.el9_5.2 ELSA-2025-2471
Oracle Linux 9 python3-tornado 6.4.2-1.el9_5 ELSA-2024-10590
Oracle Linux 8 pcs +1 0.10.18-2.0.1.el8_10.4 ELSA-2025-2872

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling airflow 2.10.3-r2 —
Wolfi rolling dask-gateway +1 2024.1.0-r12 —
Wolfi rolling kubeflow-pipelines-visualization-server 2.3.0-r4 —
Wolfi rolling py3-tornado 6.4.2-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI tornado < 6.4.2 6.4.2 GHSA-8w49-h785-mj3c

Advisories 28

References