Log in Start free

Vulnerability · Published Oct 26, 2026 · Assigned by GitHub_M

CVE-2026-116577Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

Medium 5.3

In plain English

A medium-severity resource allocation without limits in tornado from tornadoweb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 67.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12python-tornadono fix listedDEBIAN-CVE-2026-116577
Debian:13python-tornadono fix listedDEBIAN-CVE-2026-116577
Debian:14python-tornadono fix listedDEBIAN-CVE-2026-116577
PyPItornado6.6GHSA-pcg2-g6cj-q92c
Ubuntu:24.04:LTSpython-tornadono fix listedUBUNTU-CVE-2026-116577
Ubuntu:26.04:LTSpython-tornadono fix listedUBUNTU-CVE-2026-116577
Ubuntu:26.10python-tornadono fix listedUBUNTU-CVE-2026-116577

Affected products (as reported)

VendorProductVersions
tornadoweb tornado < 6.6

Weakness: CWE-407, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References