Tornado Web Framework DoS Vulnerability via Multipart Form Data Parsing
A Denial of Service (DoS) vulnerability exists in Tornado, a Python web framework and asynchronous networking library. The issue is in the ``multipart/form-data`` parser, which continues parsing data and logs warnings even when encountering errors. This behavior allows remote attackers to generate an extremely high volume of logs, creating a DoS attack. The vulnerability is made worse by Tornado's synchronous logging subsystem. All versions before 6.5.0 are affected, with the vulnerable parser enabled by default. Users should upgrade to Tornado version 6.5.0 to receive a patch. As an alternative mitigation, blocking `Content-Type: multipart/form-data` at the proxy level can help reduce the risk.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
tornadoweb tornado |
Vulmon