Support Forum

If you don't see min_spare and max_spare in __init__.py then you will not see DOS.

This is how I re-produced. ab -n3000 -c300 http://localhost:8000/ This is ApacheBench, Version 2.3 <$Revision: 655654 $> Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/ Licensed to The Apache Software Foundation, http://www.apache.org/ Benchmarking localhost (be patient) apr...

I think you might be seeing the problem. Otherwise a successful report should look like. [root@localhost ]# ab -n400 -c40 http://localhost:8000/ This is ApacheBench, Version 2.3 <$Revision: 655654 $> Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/ Licensed to The Apache Soft...

Looks like you are using threadpool but not sure if you are using recent cherrypy. In any case if you check wsgiserver/__init__.py and don't see min_spare and max_spare, then your setup is not vunerable. It's the introduction of min_spare and max_spare that has caused the problem. class ThreadPool(o...

The problem happens if there are >150 (also depends on the system capability) concurrent connection, number of threads of the process will drop down.

ab -n 5000 -c 200 <host:port>

But before that you may want to check _cpserver.py threadpool settings. May be you are not using thread pool.

I used this tool
http://en.wikipedia.org/wiki/ApacheBench

To trigger it with default setting you need lot of VM's. For single system test, you may want to make following changes in _cpserver.py thread_pool = 5 thread_pool_max = -1 thread_pool_min_spare = 2 thread_pool_max_spare = 5 Start appserver. run pstack and make sure there are no more than 10 threads...

It very easy to re-produce. Just connect to http port in a loop. Or download some test tool to hit http port.
I have posted patch fix for above bug. Let me know if anyone need fix.

I also saw same issue during high load. Fixed issue and opened a bug for upstream cherrypy.
https://bitbucket.org/cherrypy/cherrypy ... nder-heavy