This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author Matthew Belisle
Recipients Matthew Belisle
Date 2018-10-01.21:23:27
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <>
Copied from email to

I have been doing memory profiling on a few python web frameworks and I noticed this issue in the cgi.FieldStorage class.

$ python
Memory used: 523935744 bytes

The problem is there is no easy way to limit the number of MiniFieldStorage objects created by FieldStorage, so it goes unchecked in many frameworks like pyramid, pylons, webapp2, and flask. The end result is that on these frameworks, a 9MB request body (gzipped down to 9KB) can chew up ~500MB of memory on the server which is enough to effectively DOS it. The obvious way to prevent this currently is to check the content-length header and fail if it exceeds some value. But that solution has a major shortcoming because many frameworks want to allow large payloads, sometimes up to 10MB, as long as they contain a reasonable number of fields.

After talking with the
 team and pylons dev team about it, we think the best solution is to add a max_num_fields param to the FieldStorage class, defaulting to None, which throws an error if max_num_fields is exceeded.
Date User Action Args
2018-10-01 21:23:28Matthew Belislesetrecipients: + Matthew Belisle
2018-10-01 21:23:27Matthew Belislesetmessageid: <>
2018-10-01 21:23:27Matthew Belislelinkissue34866 messages
2018-10-01 21:23:27Matthew Belislecreate