Description
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.
Remediation
References
Related Vulnerabilities
WordPress Plugin HK Exif Tags Cross-Site Scripting (1.11)
WordPress Server-Side Request Forgery (SSRF) Vulnerability (CVE-2016-4029)
Oracle Database Server Other Vulnerability (CVE-2007-1442)
WordPress Plugin Daily Inspiration Generator Cross-Site Scripting (2.0)
WordPress Plugin WOOCS-Currency Switcher for WooCommerce Professional Cross-Site Scripting (1.3.7)