I just released 0.10.7 (security release). It fixes a possible DoS vulnerability that is caused by hash collisions in CPython dicts.

This bug is not specific to bottle. I you are using other frameworks, check for updates there too.

Details: https://cryptanalysis.eu/blog/2011/12/28/effective-dos-attacks-against-web-application-plattforms-hashdos/

"If the language does not provide a randomized hash function or the application server does not recognize attacks using multi-collisions, an attacker can degenerate the hash table by sending lots of colliding keys. The algorithmic complexity of inserting n elements into the table then goes to O(n**2), making it possible to exhaust hours of CPU time using a single HTTP request."

This workaround limits the number of GET, POST and cookie parameters to a reasonable number of 100 key/value pairs per request, reducing the effectiveness of attacks. Normal web applications should not need to process more than 100 parameters per request, but this limit can be changed by setting Request.MAX_PARAMS to a different value.

Some more links:

• http://events.ccc.de/congress/2011/Fahrplan/events/4680.en.html
• http://www.nruns.com/_downloads/advisory28122011.pdf
• https://github.com/bottlepy/bottle/commit/6946695b69f5493fb063c351400ff759323a31aa