Fix Lack of Resources & Rate Limiting in CherryPy
CherryPy's minimalist philosophy means it ships with permissive defaults that are ripe for exploitation. Without explicit resource constraints, an attacker can trigger Denial of Service (DoS) via thread pool exhaustion, Slowloris attacks, or memory bloating through massive request bodies. To defend the stack, we must enforce strict socket timeouts, cap the thread pool, and implement a custom tool for rate limiting.
The Vulnerable Pattern
import cherrypyclass VulnerableApp: @cherrypy.expose def index(self): return ‘Default configuration: No limits, no safety.’
if name == ‘main’: # Default settings allow unlimited request body sizes and large thread pools # No rate limiting middleware is present cherrypy.quickstart(VulnerableApp())
The Secure Implementation
The hardened configuration addresses resource exhaustion at the server level. Setting 'server.socket_timeout' prevents attackers from holding connections open indefinitely (Slowloris). Capping 'server.thread_pool' ensures the system remains responsive under load by preventing context-switching overhead from too many concurrent threads. 'server.max_request_body_size' is critical to prevent RAM exhaustion from oversized payloads. Finally, the custom 'rate_limit' Tool provides a hook into the request lifecycle to drop traffic from abusive IPs before the application processes the request logic.
import cherrypy from cherrypy import ToolMock store for rate limiting (Use Redis in production)
IP_TRACKER = {}
def check_rate_limit(): ip = cherrypy.request.remote.ip IP_TRACKER[ip] = IP_TRACKER.get(ip, 0) + 1 if IP_TRACKER[ip] > 100: # Threshold raise cherrypy.HTTPError(429, ‘Too Many Requests’)
cherrypy.tools.rate_limit = Tool(‘before_handler’, check_rate_limit)
config = { ‘global’: { ‘server.socket_timeout’: 5, # Mitigate Slowloris ‘server.thread_pool’: 10, # Prevent thread exhaustion ‘server.max_request_body_size’: 1048576, # Limit to 1MB ‘server.max_request_header_size’: 8192, ‘tools.rate_limit.on’: True } }
class HardenedApp: @cherrypy.expose def index(self): return ‘Hardened: Resources capped and rate limited.’
if name == ‘main’: cherrypy.quickstart(HardenedApp(), ’/’, config)
Your CherryPy API
might be exposed to Lack of Resources & Rate Limiting
74% of CherryPy apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.