Live › vulnerability › CVE-2026-116577
Go to dashboardTornado's HTTP header parser handles obsolete line folding with quadratic CPU cost, so a crafted header block ties up the IOLoop thread. An unauthenticated client can block other connections served by the same process, but nothing beyond availability is affected.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Any Python service that runs Tornado before 6.6 and accepts HTTP requests from clients the operator does not control is exposed. Services behind a proxy that rejects obsolete line folding, or that do not expose Tornado to untrusted traffic, carry less risk. The sources do not say which proxies reject folding by default.
No product ranges from the sources yet.
python -c "import tornado; print(tornado.version)" in the application environment and compare with 6.6pip show tornado or check the lock file for the tornado version6.6 or later with pip install --upgrade "tornado>=6.6"Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-116577")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.