UBUNTU-CVE-2026-116577: Medium severity ubuntu/python-tornado vulnerability

Published Oct 26, 2026

Updated

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with maxheadersize, and only availability is affected. This issue is fixed in version 6.6.

Affected Software

7 affected components

ubuntu/python-tornado*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Tornado to a version that resolves this vulnerability.
Fixed in 6.6

Event History

Oct 26, 2026

CVE Published

via OSV·09:18 PM

Data Sourced

via OSV·09:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

Any network-accessible service using Tornado before version 6.6 may be exposed because an unauthenticated client can send the malicious HTTP headers before application code runs. The impact is limited to availability of connections handled by the affected process.

Does exploitation require credentials or user interaction?

No. Exploitation requires only the ability to submit an HTTP request with a header block containing many obsolete line-folding continuation lines; no authentication or user interaction is required.

What makes the resource consumption severe?

Tornado repeatedly concatenates short folded header continuation lines, resulting in quadratic CPU consumption on the IOLoop thread. The processing cost increases with the configured max_header_size, and other connections served by that process can be blocked.

What version resolves the issue?

The issue is fixed in Tornado version 6.6. Systems running versions prior to 6.6 are affected according to the provided information.

UBUNTU-CVE-2026-116577: Medium severity ubuntu/python-tornado vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

Does exploitation require credentials or user interaction?

What makes the resource consumption severe?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

Does exploitation require credentials or user interaction?

What makes the resource consumption severe?

What version resolves the issue?