What’s Vulnerable › Vulnerabilities

CVE-2026-116577: Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-26 · updated 2026-10-31
• Weakness: CWE-407

Description

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.

Affected products

• tornadoweb tornado: before 6.6

References

• https://github.com/tornadoweb/tornado/commit/1b7a1dc9f340f52de929852e8125aa12f25297c9
• https://github.com/tornadoweb/tornado/pull/3765
• https://github.com/tornadoweb/tornado/releases/tag/v6.6.0
• https://github.com/tornadoweb/tornado/security/advisories/GHSA-pcg2-g6cj-q92c

Get alerted when CVE-2026-116577 or the next vulnerability affects your stack