Allocation of Resources Without Limits or Throttling

Summary

Tornado is a Python web framework and asynchronous networking library. When Tornado's `multipart/form-data` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a Denial-of-Service (DoS) attack. This DoS is compounded by the fact that the logging subsystem is synchronous. The vulnerable parser is enabled by default. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy. This issue affects tornado versions prior to 6.5.0.