A critical Denial of Service vulnerability in the Tornado web framework allows unauthenticated remote attackers to exhaust server resources through inefficient header processing.

This vulnerability is an instance of uncontrolled resource consumption (CWE-400) occurring within the HTTPHeaders.add method. Unauthenticated attackers can trigger O(n²) time complexity by repeatedly sending the same header name, effectively blocking the server event loop and causing a Denial of Service.

The ability for an unauthenticated attacker to remotely induce a Denial of Service poses a significant risk to service availability and business continuity. While the CVSS score of 7.5 reflects a high severity, the actual impact is dependent on the configuration of the max_header_size parameter, which could potentially lead to complete system unresponsiveness.

Immediate Action: Update the Tornado library to version 6.5.3 or later to incorporate the performance improvements and security fix.

Proactive Monitoring: Monitor server CPU and event loop latency for sudden spikes that correlate with incoming HTTP traffic.

Compensating Controls: If an immediate update is not feasible, implement strict limits on HTTP header sizes and request rates at the Web Application Firewall or reverse proxy layer to mitigate the impact of malicious payloads.

Public Exploit Available: Unknown

Given the ease of exploitation and the potential for service disruption, organizations utilizing the Tornado web framework must prioritize upgrading to version 6.5.3. Ensuring that infrastructure is not susceptible to uncontrolled resource consumption is essential for maintaining robust and available web services.