{"id":"CVE-2026-116577","kind":"vulnerability","aliases":["CVE-2026-116577"],"related":[],"title":"Tornado: obsolete header line folding lets a request stall the server","description":"Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.","summary":"Tornado's HTTP header parser handles obsolete line folding with quadratic CPU cost, so a crafted header block ties up the IOLoop thread. An unauthenticated client can block other connections served by the same process, but nothing beyond availability is affected.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","python","self-hosted","tornado"],"not_affected_if":["no-untrusted-traffic","tornado-6.6-or-later"],"how_to_check":"- Run `python -c \"import tornado; print(tornado.version)\"` in the application environment and compare with `6.6`\n- Run `pip show tornado` or check the lock file for the tornado version","fix":"- Upgrade tornado to `6.6` or later with `pip install --upgrade \"tornado>=6.6\"`","status":"open","published_at":"2026-10-26T21:18:14+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","triaged_at":"2026-10-26T21:21:16+00:00","updated_at":"2026-10-26T21:21:16+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T21:21:16Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade tornado to `6.6` or later with `pip install --upgrade \"tornado>=6.6\"`","reach":"internet","title":"Tornado: obsolete header line folding lets a request stall the server","impact":"low","summary":"Tornado's HTTP header parser handles obsolete line folding with quadratic CPU cost, so a crafted header block ties up the IOLoop thread. An unauthenticated client can block other connections served by the same process, but nothing beyond availability is affected.","category":"package","nicknames":[],"who_cares":["python","tornado","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Denial of service: other connections on the process stall","analyst_note":"","how_to_check":"- Run `python -c \"import tornado; print(tornado.version)\"` in the application environment and compare with `6.6`\n- Run `pip show tornado` or check the lock file for the tornado version","needs_analyst":false,"not_affected_if":["tornado-6.6-or-later","no-untrusted-traffic"],"who_is_affected":"Any Python service that runs Tornado before 6.6 and accepts HTTP requests from clients the operator does not control is exposed. Services behind a proxy that rejects obsolete line folding, or that do not expose Tornado to untrusted traffic, carry less risk. The sources do not say which proxies reject folding by default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000596,"input_tokens":3370,"output_tokens":518,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116577':14A,17A '-2026':13A,16A '6.6':77C,145C 'accept':83C 'affect':64B,138C 'applic':117C 'asynchron':72C 'avail':62B,136C 'beyond':61B 'block':41B,51B,108C,120C 'caus':93C 'client':49B,103C 'code':118C 'concaten':89C 'connect':53B,122C 'consumpt':96C 'contain':109C 'continu':91C,115C 'cost':36B,128C 'cpu':35B,95C 'craft':39B 'cve':12A,15A 'fix':142C 'fold':5A,32B,86C,114C 'framework':70C 'grow':129C 'handl':29B 'header':3A,27B,40B,81C,107C,132C 'host':22B 'http':26B,80C 'ioloop':45B,99C 'issu':140C 'let':6A 'librari':74C 'line':4A,31B,85C,92C,113C 'line-fold':112C 'mani':110C 'max':131C 'network':73C 'noth':60B 'obsolet':2A,30B,84C,111C 'packag':18B 'parser':28B,82C 'prior':75C 'process':58B,126C 'python':19B,68C 'quadrat':34B,94C 'repeat':88C 'request':8A 'run':119C 'self':21B 'self-host':20B 'serv':54B,123C 'server':11A 'short':90C 'size':133C 'stall':9A 'submit':105C 'thread':46B,100C 'tie':42B 'tornado':1A,23B,24B,65C,78C 'unauthent':48B,102C 'version':144C 'web':69C","nicknames":[],"mitigations":[],"who_affected":"Any Python service that runs Tornado before 6.6 and accepts HTTP requests from clients the operator does not control is exposed. Services behind a proxy that rejects obsolete line folding, or that do not expose Tornado to untrusted traffic, carry less risk. The sources do not say which proxies reject folding by default.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116577","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116577","severity":null,"published_at":"2026-10-26T21:18:14+00:00","modified_at":"2026-10-26T21:18:14+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","fetched_at":"2026-10-26T21:20:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}