# CVE-2024-52804: python3-tornado: Tornado is a Python web framework and asynchronous networking library CVE-2024-52804 is fixed in 8 products on 1 platform, first by python-tornado 4.5.3-1ubuntu0.2+esm1, released November 22, 2024. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2024-52804 - Priority: High - CVSS: 7.5 (Medium) - EPSS: 0.0104 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Nov 22, 2024 ## Description Tornado is a Python web framework and asynchronous networking library. Thealgorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2sometimes has quadratic complexity, leading to excessive CPU consumptionwhen parsing maliciously-crafted cookie headers. This parsing occurs in theevent loop thread and may block the processing of other requests. Version6.4.2 fixes the issue. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | pcs RHEL 8 | 0:0.10.18-2.el8_10.4 | [RHSA-2025:2872](https://patchblox.com/security/data/fix/linux/rhsa-2025-2872.md) | Mar 17, 2025 | | Linux | pcs RHEL 9 | 0:0.11.8-1.el9_5.2 | [RHSA-2025:2471](https://patchblox.com/security/data/fix/linux/rhsa-2025-2471.md) | Mar 10, 2025 | | Linux | pcs almalinux 8 | 0.10.18-2.el8_10.4.alma.1 | [ALSA-2025:2872](https://patchblox.com/security/data/fix/linux/alsa-2025-2872.md) | Mar 17, 2025 | | Linux | pcs ol 8 | 0:0.10.18-2.0.1.el8_10.4 | [ELSA-2025-2872](https://patchblox.com/security/data/fix/linux/elsa-2025-2872.md) | Mar 18, 2025 | | Linux | pcs ol 9 | 0:0.11.8-1.el9_5.2 | [ELSA-2025-2471](https://patchblox.com/security/data/fix/linux/elsa-2025-2471.md) | Mar 12, 2025 | | Linux | pcs rocky 8 | 0:0.10.18-2.el8_10.4 | [RLSA-2025:2872](https://patchblox.com/security/data/fix/linux/rlsa-2025-2872.md) | May 7, 2025 | | Linux | pcs rocky 9 | 0:0.11.8-1.el9_5.2 | [RLSA-2025:2471](https://patchblox.com/security/data/fix/linux/rlsa-2025-2471.md) | Jul 29, 2025 | | Linux | pcs-snmp RHEL 8 | 0:0.10.18-2.el8_10.4 | [RHSA-2025:2872](https://patchblox.com/security/data/fix/linux/rhsa-2025-2872.md) | Mar 17, 2025 | | Linux | pcs-snmp RHEL 9 | 0:0.11.8-1.el9_5.2 | [RHSA-2025:2471](https://patchblox.com/security/data/fix/linux/rhsa-2025-2471.md) | Mar 10, 2025 | | Linux | pcs-snmp almalinux 8 | 0.10.18-2.el8_10.4.alma.1 | [ALSA-2025:2872](https://patchblox.com/security/data/fix/linux/alsa-2025-2872.md) | Mar 17, 2025 | | Linux | pcs-snmp ol 8 | 0:0.10.18-2.0.1.el8_10.4 | [ELSA-2025-2872](https://patchblox.com/security/data/fix/linux/elsa-2025-2872.md) | Mar 18, 2025 | | Linux | pcs-snmp ol 9 | 0:0.11.8-1.el9_5.2 | [ELSA-2025-2471](https://patchblox.com/security/data/fix/linux/elsa-2025-2471.md) | Mar 12, 2025 | | Linux | python-tornado Debian 12.15 (bookworm) | 6.2.0-3+deb12u1 | [DEBIAN-CVE-2024-52804](https://patchblox.com/security/data/fix/linux/debian-cve-2024-52804.md) | Nov 22, 2024 | | Linux | python-tornado Debian 13.5 (trixie) | 6.4.2-1 | [DEBIAN-CVE-2024-52804](https://patchblox.com/security/data/fix/linux/debian-cve-2024-52804.md) | Nov 22, 2024 | | Linux | python-tornado Debian 14 | 6.4.2-1 | [DEBIAN-CVE-2024-52804](https://patchblox.com/security/data/fix/linux/debian-cve-2024-52804.md) | Nov 22, 2024 | | Linux | python-tornado Ubuntu 18.04.6 LTS (bionic) | 4.5.3-1ubuntu0.2+esm1 | [python-tornado 4.5.3-1ubuntu0.2+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python-tornado-4.5.3-1ubuntu0.2-esm1.md) | Nov 22, 2024 | | Linux | python-tornado rocky 9 | 0:6.4.2-1.el9_5 | [RLSA-2024:10590](https://patchblox.com/security/data/fix/linux/rlsa-2024-10590.md) | Mar 17, 2025 | | Linux | python-tornado-debugsource amzn 2023 | 6.1.0-2.amzn2023.0.4 | [ALAS2023-2025-792](https://patchblox.com/security/data/fix/linux/alas2023-2025-792.md) | Jan 6, 2025 | | Linux | python-tornado-doc amzn 2023 | 6.1.0-2.amzn2023.0.4 | [ALAS2023-2025-792](https://patchblox.com/security/data/fix/linux/alas2023-2025-792.md) | Jan 6, 2025 | | Linux | python-tornado6 opensuse-leap 15.6 | 6.3.2-150400.9.6.1 | [SUSE-SU-2024:4137-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-4137-1.md) | Dec 2, 2024 | | Linux | python-tornado6 sles 15.6 | 6.3.2-150400.9.6.1 | [SUSE-SU-2024:4137-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-4137-1.md) | Dec 2, 2024 | | Linux | python3-tornado RHEL 9 | 0:6.4.2-1.el9_5 | [RHSA-2024:10590](https://patchblox.com/security/data/fix/linux/rhsa-2024-10590.md) | Dec 2, 2024 | | Linux | python3-tornado Ubuntu 18.04.6 LTS (bionic) | 4.5.3-1ubuntu0.2+esm1 | [python3-tornado 4.5.3-1ubuntu0.2+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python3-tornado-4.5.3-1ubuntu0.2-esm1.md) | Nov 22, 2024 | | Linux | python3-tornado Ubuntu 20.04 LTS (focal) | 6.0.3+really5.1.1-3ubuntu0.1~esm1 | [python3-tornado 6.0.3+really5.1.1-3ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-python3-tornado-6.0.3-really5.1.1-3ubuntu0.1-esm1.md) | Nov 22, 2024 | | Linux | python3-tornado Ubuntu 22.04.1 LTS (jammy) | 6.1.0-3ubuntu0.1~esm1 | [python3-tornado 6.1.0-3ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-python3-tornado-6.1.0-3ubuntu0.1-esm1.md) | Nov 22, 2024 | | Linux | python3-tornado Ubuntu 24.04.5 LTS (noble) | 6.4.0-1ubuntu0.1 | [python3-tornado 6.4.0-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-python3-tornado-6.4.0-1ubuntu0.1.md) | Nov 22, 2024 | | Linux | python3-tornado Ubuntu 24.10 (oracular) | 6.4.1-2ubuntu0.1 | [python3-tornado 6.4.1-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-python3-tornado-6.4.1-2ubuntu0.1.md) | Jan 16, 2026 | | Linux | python3-tornado Ubuntu 25.04 (plucky) | 6.4.2-1 | [python3-tornado 6.4.2-1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-python3-tornado-6.4.2-1.md) | Jan 16, 2026 | | Linux | python3-tornado Ubuntu 25.10 (questing) | 6.4.2-1 | [python3-tornado 6.4.2-1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-python3-tornado-6.4.2-1.md) | Nov 22, 2024 | | Linux | python3-tornado almalinux 9 | 6.4.2-1.el9_5 | [ALSA-2024:10590](https://patchblox.com/security/data/fix/linux/alsa-2024-10590.md) | Dec 2, 2024 | | Linux | python3-tornado amzn 2023 | 6.1.0-2.amzn2023.0.4 | [ALAS2023-2025-792](https://patchblox.com/security/data/fix/linux/alas2023-2025-792.md) | Jan 6, 2025 | | Linux | python3-tornado ol 9 | 0:6.4.2-1.el9_5 | [ELSA-2024-10590](https://patchblox.com/security/data/fix/linux/elsa-2024-10590.md) | Dec 2, 2024 | | Linux | python3-tornado-debuginfo amzn 2023 | 6.1.0-2.amzn2023.0.4 | [ALAS2023-2025-792](https://patchblox.com/security/data/fix/linux/alas2023-2025-792.md) | Jan 6, 2025 | --- Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.