Tornado has a DoS due to too many multipart parts

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.

N/A

未加控制的资源消耗(资源穷尽)

Tornado 资源管理错误漏洞

Tornado是中国龙卷风科技（Tornado）社区的一个Python Web框架和异步网络库。该库通过使用非阻塞网络I / O，可以扩展到成千上万的开放连接，使其非常适合 长时间轮询， WebSocket和其他需要与每个用户建立长期连接的应用程序。 Tornado 6.5.5之前版本存在资源管理错误漏洞，该漏洞源于解析多部分表单数据时缺少部分数量限制，可能导致拒绝服务攻击。

N/A

N/A