CyberRota Analysis
AI-GeneratedTornado's gzip decompression routines prior to version 6.5.6 are vulnerable to a denial-of-service attack due to the lack of an overall limit on accumulated decompressed chunks, which can lead to excessive memory consumption when processing requests from a malicious server. This vulnerability poses a significant risk to applications using Tornado with the SimpleAsyncHTTPClient or HTTPServer configured with decompress_request=True. Organizations utilizing Tornado in their web applications should prioritize upgrading to version 6.5.6 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer configured with decompress_request=True to consume effectively unlimited memory. This issue is fixed in version 6.5.6.