GHSA-8423-8fgw-73vq: tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)
parse_multipart_form_data (httputil.py:34) calls
data.split(b"--"+boundary+b"\r\n") before the max_parts check (:35).
A 600KB body with 100k parts creates a 100k-element transient list first,
then rejects transient memory amplification (each split element is a copy).
Pre-auth HTTP DoS.
References
- gist.github.com/afldl/649861f25d39b53b7edbe0298e171617
- github.com/advisories/GHSA-8423-8fgw-73vq
- github.com/tornadoweb/tornado/commit/de85b3f87446e323e881bbaa3d5a74f4b76e5f05
- github.com/tornadoweb/tornado/pull/3704
- github.com/tornadoweb/tornado/releases/tag/v6.5.8
- github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq
Code Behaviors & Features
Detect and mitigate GHSA-8423-8fgw-73vq with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →