Threats tagged 'ghsa-r4j5-9xpp-3985'

Tornado HTTP servers prior to version 6.6 are vulnerable to event loop blocking and excessive memory use when processing HTTP/1.1 chunked transfer encoded bodies composed of many small chunks. An attacker can send a request body with millions of 1-byte chunks, causing the server's event loop to block for extended periods (up to a minute for bodies near 100 MB), impacting all connections served by the process. This vulnerability also affects Tornado's SimpleAsyncHTTPClient when reading responses from malicious servers. The issue is fixed in Tornado 6.6, which introduces periodic yielding to the event loop and more efficient chunk handling.