Riskcovery

CVE-2026-116577

Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

State
Published
Severity
5.3 Medium
Published
Oct 26, 2026
Updated
Oct 26, 2026
Reserved
Oct 26, 2026

Read the record on cve.org

Description

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LGitHub_M

Weaknesses

  • CWE-407 Inefficient Algorithmic Complexity
  • CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

ProductVersions
tornadotornadoweb
  • < 6.6Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.