PT-2026-85146 · Pypi · Tornado
Publicado
2026-09-01
·
Atualizado
2026-09-01
CVSS v4.0
6.9
Média
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
Description
Summary
parse multipart form data (httputil.py:34) calls
data.split(b"--"+boundary+b"r ") before the max parts check (:35).
A 600KB body with 100k parts creates a 100k-element transient list first,
then rejects transient memory amplification (each split element is a copy).
Pre-auth HTTP DoS.Root cause
python
parts = data[:final boundary index].split(b"--" + boundary + b"r
") # :34 huge list first
if len(parts) > config.max parts: # :35 check after
raise HTTPInputError("multipart/form-data has too many parts")PoC
gist: https://gist.github.com/afldl/649861f25d39b53b7edbe0298e171617
poc.py + output.txt (100k parts from 600KB transient list).Fix
Count separators without materializing the list (e.g.
data.count(b"--"+boundary) first).Credit
Reported by afldl, 2026-07.
Correção
Allocation of Resources Without Limits
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Tornado