Description
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.
Remediation
References
Related Vulnerabilities
Joomla! Core Multiple Vulnerabilities (2.5.0 - 3.10.6)
WordPress Plugin Parcel Tracker eCourier Cross-Site Request Forgery (1.0.1)
MySQL CVE-2021-2028 Vulnerability (CVE-2021-2028)
WordPress Plugin Project Status Cross-Site Scripting (1.6)
TYPO3 Improper Authentication Vulnerability (CVE-2023-47127)