An unauthenticated remote denial of service vulnerability in the Tornado web framework allows attackers to stall the single-threaded event loop via malicious request bodies.

The application fails to limit the number of fields parsed in application/x-www-form-urlencoded request bodies, allowing an unauthenticated attacker to send a specially crafted request that triggers excessive resource consumption and stalls the event loop.

This vulnerability poses a significant risk to service availability by enabling a remote, unauthenticated attacker to cause a denial of service. With a CVSS score of 7.5, the flaw is classified as high severity, as it can disrupt critical business operations by forcing the single-threaded Tornado event loop to hang, thereby delaying or dropping all legitimate network connections.

Immediate Action: Upgrade to Tornado version 6.5.8 or later to incorporate the necessary input validation constraints.

Proactive Monitoring: Monitor server CPU and memory utilization for sudden, unexplained spikes and review application logs for unusually large or malformed POST requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) or load balancer to inspect and limit the size and complexity of incoming HTTP request bodies before they reach the Tornado application.

Public Exploit Available: No

Given the ease of exploitation, which requires no authentication, and the potential for complete service interruption, administrators should prioritize this update. Applying the patch to version 6.5.8 is the only definitive way to remediate the underlying resource consumption logic. All production environments running versions prior to 6.5.8 must be updated immediately to maintain service availability and resilience against denial of service attacks.