---
id: "CVE-2026-116577"
kind: "vulnerability"
aliases: ["CVE-2026-116577"]
title: "Tornado: obsolete header line folding lets a request stall the server"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "python", "self-hosted", "tornado"]
not_affected_if: ["no-untrusted-traffic", "tornado-6.6-or-later"]
published_at: "2026-10-26T21:18:14+00:00"
first_seen_at: "2026-10-26T21:20:31+00:00"
updated_at: "2026-10-26T21:21:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116577", "first_seen_at": "2026-10-26T21:20:31+00:00"}]
---

# Tornado: obsolete header line folding lets a request stall the server

Tornado's HTTP header parser handles obsolete line folding with quadratic CPU cost, so a crafted header block ties up the IOLoop thread. An unauthenticated client can block other connections served by the same process, but nothing beyond availability is affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `python -c "import tornado; print(tornado.version)"` in the application environment and compare with `6.6`
- Run `pip show tornado` or check the lock file for the tornado version

## Fix

- Upgrade tornado to `6.6` or later with `pip install --upgrade "tornado>=6.6"`

## Timeline

- 2026-10-26T21:20:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116577

## From the sources

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_