The ThreadingMixIn class (used byThreadingUDPServer/ThreadingTCPServer/...) server stopped using
daemon_threads by default with Python 3.7. But the releasing of the threads is only done by Threading*Server when the server closes. So in the meantime, all threads are gathered in the server object and thus we "leak" memory over the lifetime of the server.
An attacker can therefore cause an OOM based DOS by just requesting some resources again and again:
The ThreadingMixIn class (used byThreadingUDPServer/ThreadingTCPServer/...) server stopped using daemon_threads by default with Python 3.7. But the releasing of the threads is only done by Threading*Server when the server closes. So in the meantime, all threads are gathered in the server object and thus we "leak" memory over the lifetime of the server.
An attacker can therefore cause an OOM based DOS by just requesting some resources again and again:
To work around this, the server can be forced back to use daemon_threads.
An actual fix for this problem has to be integrated by upstream. Like the patches already started in PR https://github.com/python/cpython/pull/13893