19 matches found
SUSE CVE-2026-116577
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a head...
Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
Summary Tornado's HTTP header parser takes quadratic time On² when a header value is continued across many "obsolete line folding" obs-fold lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a large amount of CPU on the...
GHSA-PCG2-G6CJ-Q92C Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
Summary Tornado's HTTP header parser takes quadratic time On² when a header value is continued across many "obsolete line folding" obs-fold lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a large amount of CPU on the...
EUVD-2026-110318
Tornado: Quadratic CPU usage when parsing HTTP headers with line folding...
Linux Distros Unpatched Vulnerability : CVE-2026-116577
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly...
CVE-2026-116577
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a head...
DEBIAN-CVE-2026-116577
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a head...
CVE-2026-116577
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a head...
TornadoWeb Tornado resource management error vulnerability
Versions of TornadoWeb prior to 6.6 contain a resource management error vulnerability. This vulnerability arises because the HTTP header parser performs line folding and repeatedly concatenates short continuation lines upon receipt, resulting in a quadratic increase in CPU consumption on IOLoop...
PT-2026-125125
Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.6 Description The HTTP header parser in this Python web framework and asynchronous networking library accepts obsolete line folding. An unauthenticated client can submit a header block with numerous short continuati...
CVE-2026-103261 Tornado before 6.5.9 Denial of Service via Query String
Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.init, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts ...
CVE-2026-103261
Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.init, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts ...
CVE-2026-103261 Tornado before 6.5.9 Denial of Service via Query String
Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.init, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts ...
CVE-2026-67199
Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large...
CVE-2026-67199
Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large...
CVE-2026-67199 Perspective 5.0.0 DoS via Loop Expression Evaluation
Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large...
CVE-2026-67199 Perspective 5.0.0 DoS via Loop Expression Evaluation
Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large...
PT-2026-67724
Name of the Vulnerable Software and Affected Versions Perspective version 5.0.0 Description A denial of service issue exists where remote attackers can block the server event loop indefinitely. This occurs by submitting a crafted expression containing unbounded for or while loop constructs within...
linux/x86 cat /dev/urandom > /dev/console, just for kicks - 63 bytes
No description provided by source. / linux/x86 cat /dev/urandom /dev/console, no real profit just for kicks - 63 bytes - izik [email protected] / char shellcode = "\x31\xc9" // xor %ecx,%ecx "\x51" // push %ecx "\x68\x6e\x64\x6f\x6d" // push $0x6d6f646e "\x68\x2f\x75\x72\x61" // push $0x6172752f...