CVE-2026-116577— Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

Quick assessment

Affected

tornadoweb tornado

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Tornado 是一个 Python 网络框架和异步网络库。在 6.6 版本之前，Tornado 的 HTTP 头部解析器会接受已过时的行折叠（line folding）机制，并反复拼接较短的续行，导致 IOLoop 线程出现二次方（O(n²)）级别的 CPU 消耗。未认证的客户端可在应用程序代码执行之前，提交包含大量过时行折叠续行的头部块，从而阻塞由该进程服务的其他连接。该问题的开销随配置增大而增加，仅影响服务的可用性。此问题已在 6.6 版本中修复。

CVSS 5.3 · Medium Updated Oct 27, 2026

Possible ATT&CK Techniques 1 AI

T1499.003 · Application Exhaustion Flood

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

Source: CVE Program / CVE List V5

Vulnerability Description

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

算法复杂性

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
tornadoweb	tornado	< 6.6	-

II. Public POCs for CVE-2026-116577

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116577

请登录查看更多情报信息。

Other References for CVE-2026-116577 (4)

httputil: Remove support for "obsolete line folding" by bdarnell · Pull Request #3765 · tornadoweb/tornado x_refsource_MISC
Release v6.6.0: What's new in Tornado 6.6.0 · tornadoweb/tornado · GitHub x_refsource_MISC
Quadratic CPU usage when parsing HTTP headers with line folding · Advisory · tornadoweb/tornado · GitHub x_refsource_CONFIRM
httputil: Remove support for "obsolete line folding" · tornadoweb/tornado@1b7a1dc · GitHub x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-116577

Same Patch Batch · tornadoweb · 2026-10-26 · 3 CVEs total

CVE-2026-115927	5.3 MEDIUM	Tornado: Event loop blocking and excess memory use from chunked bodies with many small chu
CVE-2026-116578	2.1 LOW	Tornado: Open redirect in RedirectHandler via protocol-relative URLs

IV. Related Vulnerabilities

Same product: tornado

Same vendor: tornadoweb

Same weakness: CWE-407