ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-116577

Tornado is a Python web framework and asynchronous networking library.

Published Oct 26, 2026 · catalog updated Oct 31, 2026 · Red Hat Red Hat Enterprise Linux

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-116577. EPSS is 0.38%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
Medium5.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.38%
Remediation
Version ranges on file
Affected products
Debian:12 python-tornado · Debian:13 python-tornado · Debian:14 python-tornado · PyPI tornado · pip tornado · pypi tornado

### Summary Tornado's HTTP header parser takes quadratic time (O(n²)) when a header value is continued across many "obsolete line folding" (obs-fold) lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a large amount of CPU on the IOLoop thread and blocks every other connection that process is serving. This issue is closely related to CVE-2025-67725 (GHSA-c98p-7wgm-6p64). The fix for that advisory covered repeated headers but not line-folded continuations. ### Impact All Tornado HTTP servers are affected. Header parsing runs before any application code, so no authentication or particular handler is required. How bad it gets depends on : - **Default (64 KB):** each malicious request blocks the event loop for tens of milliseconds. Repeated requests can degrade service. - **Raised :** the cost grows with the square of the header size. A single 1 MB request can block the process for several seconds. Only availability is affected. Confidentiality and integrity are not. ### Patches Fixed in Tornado 6.6 by removing support for obsolete line folding completely; header lines that begin with whitespace are now rejected. ### Workarounds - Keep at its default value or lower it. This limits the impact but doesn't remove it. - Run Tornado behind a reverse proxy that rejects or normalizes obsolete line folding before forwarding requests. ### Credit Reported by @manus-pi.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Debian:12 python-tornado6.2.0-3, 6.2.0-3+deb12u1, 6.2.0-3+deb12u2
  • Debian:13 python-tornado6.4.2-3, 6.4.2-3+deb13u1, 6.4.2-3+deb13u2
  • Debian:14 python-tornado6.4.2-3, 6.5.2-1, 6.5.2-2
  • PyPI tornado0 → 6.6
  • pip tornado< 6.6
  • pypi tornado<6.6.0

How to fix CVE-2026-116577

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-116577. EPSS is 0.38%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Which versions are affected?

Compare what you have installed with 6.2.0-3, 6.2.0-3+deb12u1, 6.2.0-3+deb12u2, 6.4.2-3, 6.4.2-3+deb13u1, 6.4.2-3+deb13u2, 6.4.2-3, 6.5.2-1, 6.5.2-2, 0 → 6.6, < 6.6, <6.6.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-1322; CWE-407; CWE-770: Allocation of Resources Without Limits or Throttling. EPSS 0.38%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Debian security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 26, 2026 · Red Hat Security Data

    Detected

    tornado: tornado: Denial of Service via obsolete HTTP header line folding

  2. Oct 27, 2026 · Trivy Vulnerability DB

    Updated

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking oth

  3. Oct 28, 2026 · GitHub Advisory Database

    Fix available

    tornado fixed in 6.6

  4. Oct 28, 2026 · GitHub Advisory Database

    Fix available

    tornado fixed in 6.6

  5. Oct 28, 2026 · GitHub Advisory Database

    Updated

    ### Summary Tornado's HTTP header parser takes quadratic time (O(n²)) when a header value is continued across many "obsolete line folding" (obs-fold) lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a large amount of CPU on the IOLoop thread and blocks every other connection that process is serving. This issue is closely r

  6. Oct 31, 2026 · NIST NVD

    Updated

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking oth

Sources

  • CVE.orgVulnerability recordCVE-2026-116577

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-pcg2-g6cj-q92c

    Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-116577

    Tornado's HTTP header parser takes quadratic time (O(n²)) when a header value is continued across many "obsolete line folding" (obs-fold) lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a large amount of CPU on the IOLoop thread and blocks every other connection that process is serving. This issue is closely related to CV

    advisories.gitlab.com
  • GitLab Advisory DatabasePackage advisorypypi/tornado/CVE-2026-116577.yml

    Tornado's HTTP header parser takes quadratic time (O(n²)) when a header + value is continued across many \"obsolete line folding\" (obs-fold) lines. An unauthenticated + attacker can send a request whose header block is mostly short continuation lines. + Parsing it uses a large amount of CPU on the IOLoop thread and blocks every other + connection that process is serving.\n\nThis issue is closely

    gitlab.com
  • NIST NVDVulnerability recordCVE-2026-116577

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client

    nvd.nist.gov
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-pcg2-g6cj-q92c

    Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

    osv.dev
  • Red Hat Security DataVendor advisoryCVE-2026-116577

    tornado: tornado: Denial of Service via obsolete HTTP header line folding

    access.redhat.com
  • Trivy Vulnerability DBPackage advisoryDEBIAN-CVE-2026-116577

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client

    osv.dev

References

Freshness

Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • NIST NVDOct 31, 2026
  • GitHub Advisory DatabaseOct 30, 2026
  • GitLab Advisory DatabaseOct 29, 2026
  • GitLab Advisory DatabaseOct 29, 2026
  • OpenSSF OSV / OSV ScannerOct 29, 2026
  • CVE.orgOct 27, 2026
  • Trivy Vulnerability DBOct 27, 2026
  • Red Hat Security DataOct 27, 2026