Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Summary Tornado parses application/x-www-form-urlencoded bodies with urllib.parse.parseqs and does not pass maxnumfields. A body made almost entirely of separators produces tens of millions of fields, and the parse happens on the event loop before the handler runs, so a single request stalls the...

FreeBSD : mod_python denial-of-service vulnerability in parse_qs (111)

The following package needs to be updated: modpython %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkg1a448eb7698811d8873f0020ed76ef5a.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright...