GHSA-pcg2-g6cj-q92c: Medium severity pip/tornado vulnerability
Summary
Tornado's HTTP header parser takes quadratic time (O(n²)) when a header value is continued across many "obsolete line folding" (obs-fold) lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a large amount of CPU on the IOLoop thread and blocks every other connection that process is serving.
This issue is closely related to CVE-2025-67725 (GHSA-c98p-7wgm-6p64). The fix for that advisory covered repeated headers but not line-folded continuations.
Impact
All Tornado HTTP servers are affected. Header parsing runs before any application code, so no authentication or particular handler is required.
How bad it gets depends on maxheadersize:
- Default (64 KB): each malicious request blocks the event loop for tens of milliseconds. Repeated requests can degrade service. - Raised maxheadersize: the cost grows with the square of the header size. A single 1 MB request can block the process for several seconds.
Only availability is affected. Confidentiality and integrity are not.
Patches
Fixed in Tornado 6.6 by removing support for obsolete line folding completely; header lines that begin with whitespace are now rejected.
Workarounds
- Keep maxheadersize at its default value or lower it. This limits the impact but doesn't remove it. - Run Tornado behind a reverse proxy that rejects or normalizes obsolete line folding before forwarding requests.
Credit
Reported by @manus-pi.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/tornadoto a version that resolves this vulnerability.Fixed in 6.6 - Upgrade
Upgrade
Tornadoto a version that resolves this vulnerability.Fixed in 6.6 - Configuration
Keep max_header_size at its default value or lower it.
Tornado HTTP server max_header_size = default value or lower - Compensating control
Run Tornado behind a reverse proxy that rejects or normalizes obsolete line folding before forwarding requests.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote client that can send HTTP requests to a Tornado HTTP server can trigger it. The malformed header is parsed before application code runs, so no specific endpoint, handler, or application-level authentication is required.
Are default Tornado deployments affected?
Yes. All Tornado HTTP servers are affected, including those using the default 64 KB max_header_size. At the default limit, a malicious request can block the event loop for tens of milliseconds, and repeated requests can degrade service.
What configuration makes the impact worse?
Increasing max_header_size increases the CPU cost quadratically with header size. With a 1 MB header limit, a single malicious request can block the process for several seconds.
What is the practical impact on a vulnerable server?
The attack consumes CPU while parsing folded HTTP header lines on the IOLoop thread, preventing that process from serving other connections during the delay. The provided impact is limited to availability; confidentiality and integrity are not affected.
What change fixes the issue?
Tornado 6.6 fixes the issue by completely removing support for obsolete HTTP line folding. Header lines beginning with whitespace are no longer accepted as continuations.