CVE-2026-116577
Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.
| CWE | CWE-407 CWE-770 |
| Vendor | tornadoweb |
| Product | tornado |
| Published | Oct 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for tornadoweb tornado
Be the first to know when new medium vulnerabilities affecting tornadoweb tornado are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Affected Versions
tornadoweb / tornado
< 6.6
References
github.com: https://github.com/tornadoweb/tornado/security/advisories/GHSA-pcg2-g6cj-q92c github.com: https://github.com/tornadoweb/tornado/pull/3765 github.com: https://github.com/tornadoweb/tornado/commit/1b7a1dc9f340f52de929852e8125aa12f25297c9 github.com: https://github.com/tornadoweb/tornado/releases/tag/v6.6.0