Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

GCP Compute Engine Security

JVN Japan

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Microsoft Security Blog

Google Project Zero

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Check Point Research

Kaspersky Security Blog

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A denial-of-service (DoS) vulnerability exists in the python-tornado package used by the pcs command-line configuration system for Pacemaker and Corosync utilities. The issue involves HTTP cookie parsing in Tornado, which could be exploited to cause service disruption. Red Hat has issued security advisories for Red Hat Enterprise Linux 8.8 and 9.2 Extended Update Support releases, providing updated packages to address this vulnerability.

CVE-2024-52804 is a denial of service vulnerability in the python-tornado package's HTTP cookie parsing implementation. Tornado is a Python web framework and asynchronous networking library. The vulnerability allows an attacker to cause a denial of service by exploiting the way HTTP cookies are parsed. Red Hat has issued security advisories and updates for various Red Hat Enterprise Linux 9.x versions, including Extended Update Support and Update Services for SAP Solutions, to fix this issue by updating python-tornado to version 6.4.2-1.el9_5 or later.

Detailed information about Red Hat Security Advisory: pcs security update affecting Red Hat Product Security Red Hat. Get real-time updates, technical details, 

Red Hat Security Advisory: pcs security update - Live Threat Intelligence - Threat Radar | OffSeq.com

https://access.redhat.com/errata/RHSA-2024:10836

https://access.redhat.com/security/updates/classification/#important

2328045

Canonical URL

https://access.redhat.com/errata/RHSA-2024:10590

https://access.redhat.com/errata/RHSA-2024:10843

Red Hat Security Advisory: python-tornado security update

tornado

Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.

CVE-2024-52804 is a vulnerability classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling) affecting the Tornado web framework, a popular Python asynchronous networking library. The root cause is an inefficient algorithm used for parsing HTTP cookies in Tornado versions earlier than 6.4.2. Specifically, the cookie parsing algorithm exhibits quadratic time complexity under certain crafted inputs, meaning that the CPU time required grows disproportionately with the size or complexity of the cookie header. An attacker can exploit this by sending specially crafted HTTP cookie headers that cause the Tornado server's event loop thread to consume excessive CPU resources. Since the parsing occurs in the event loop thread, this leads to blocking or significant delays in processing other incoming requests, effectively causing a denial-of-service (DoS) condition. The vulnerability can be triggered remotely without any authentication or user interaction, increasing its risk profile. Although no public exploits have been observed in the wild yet, the high CVSS score of 7.5 reflects the potential impact. The fix involves updating Tornado to version 6.4.2, where the parsing algorithm has been optimized or replaced to prevent quadratic complexity and resource exhaustion. This vulnerability is particularly critical for high-traffic Tornado-based web services where availability and responsiveness are essential.

Detailed information about CVE-2024-52804: CWE-400: Uncontrolled Resource Consumption in tornadoweb tornado affecting tornadoweb tornado. Get real-time updates,

CVE-2024-52804: CWE-400: Uncontrolled Resource Consumption in tornadoweb tornado - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-52804: CWE-400: Uncontrolled Resource Consumption in tornadoweb tornado


Red Hat Security Advisory: python-tornado security updateCVE-2024-52804 0 A denial-of-service (DoS) vulnerability exists in the python-tornado package used by the pcs command-line configuration system for Pacemaker and Corosync utilities. The issue involves HTTP cookie parsing in Tornado, which could be exploited to cause service disruption. Red Hat has issued security advisories for Red Hat Enterprise Linux 8.8 and 9.2 Extended Update Support releases, providing updated packages to address this vulnerability. HighVulnerability#gcve #csaf #cve-2024-52804 Join the discussion	GCVE Database	12/05/2024, 10:19:31 UTC Added: 06/25/2026, 21:47:02 UTC
CVE-2024-52804: CWE-400: Uncontrolled Resource Consumption in tornadoweb tornadoCVE-2024-52804 0 Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue. HighVulnerabilityGermanyFranceUnited Kingdom+5#cve #cve-2024-52804 #cwe-400 Join the discussion	CVE Database V5	11/22/2024, 15:43:38 UTC Added: 11/03/2025, 22:38:37 UTC

Threats Tagged 'cve-2024-52804'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2024-52804'

Lead Pen Test Professional