Executive brief
Tornado is a Python web framework and asynchronous networking library. A vulnerability in how it handles certain web request headers allows an attacker to send a specially crafted request that consumes excessive server processing power. Because of Tornado's design, this can cause the entire web server to become unresponsive, leading to a total service outage for all users.
Technical details
The _parseparam function in Tornado's httputil.py, used for parsing HTTP header values like multipart/form-data, contains an inefficient algorithm. Specifically, it repeatedly calls string.count() within a nested loop when processing quoted semicolons. An attacker can exploit this by sending a Content-Disposition header with a large number of crafted parameters, leading to O(n²) CPU consumption. Due to Tornado's single-threaded event loop architecture, this quadratic complexity results in a complete Denial of Service (DoS) as the event loop becomes blocked. This issue is fixed in version 6.5.3.
Affected products
- TornadoWeb Tornado < 6.5.3
Timeline
- 2025-12-11: disclosed: Initial disclosure and patch release
- 2025-12-12: advisory: NVD publication
- 2026-07-20: advisory: GitHub Advisory reviewed and updated