CVE-2026-116577: Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with maxheadersize, and only availability is affected. This issue is fixed in version 6.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tornadoto a version that resolves this vulnerability.Fixed in 6.6
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Tornado versions earlier than 6.6 are exposed when they accept HTTP requests. The vulnerable parsing occurs before application code runs, so application-level authentication or request handling does not prevent the attack.
What does an attacker need to exploit it?
An unauthenticated remote client only needs to send an HTTP header block with many obsolete line-folding continuation lines. No user interaction or prior privileges are required.
What is the practical impact on a Tornado process?
Processing the crafted headers can consume quadratic CPU time on the IOLoop thread, blocking other connections served by that process. The issue affects availability only; the provided data does not indicate confidentiality or integrity impact.
What should be done if upgrading cannot happen immediately?
The provided data identifies version 6.6 as the fix. It also states that the processing cost grows with max_header_size, so limiting that setting can reduce exposure while an upgrade is pending.