A critical vulnerability in the Tornado framework, version 6.5.2 and below, allows remote attackers to trigger a denial of service by exhausting server CPU resources.

This vulnerability involves an inefficient algorithm in the _parseparam function within httputil.py, which processes HTTP header values. An unauthenticated attacker can send a maliciously crafted Content-Disposition header to cause quadratic CPU consumption, effectively freezing the server's single event loop.

The potential impact of this vulnerability is a complete service disruption for any application relying on the affected versions of Tornado. Because the framework utilizes a single event loop architecture, a single malicious request can render the entire application unresponsive, leading to significant downtime and loss of availability. With a CVSS score of 7.5, this high-severity flaw poses a clear risk to business continuity that requires prompt remediation.

Immediate Action: Update the Tornado package to version 6.5.3 or later to incorporate the patched parsing logic.

Proactive Monitoring: Monitor server CPU usage for sudden, sustained spikes that coincide with incoming HTTP requests, as these may indicate attempted exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter or block requests containing excessively long or malformed Content-Disposition headers.

Public Exploit Available: No (exploit_available: unknown)

Given the ease with which this vulnerability can be triggered by unauthenticated remote attackers, organizations should prioritize updating their Tornado dependencies. The severity of a potential service outage in a production environment warrants immediate attention. Please ensure that all application deployments are tested with version 6.5.3 to confirm compatibility before moving to production.