Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-116577 EUVD-2026-110318GHSA-pcg2-g6cj-q92c

Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

Published Oct 26, 2026 · Updated Oct 31, 2026 · Assigned by GitHub_M

Description

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.

Affected products

VendorProductAffectedFixed
tornadoweb tornado < 6.6 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 python-tornado No fix yet —
Debian 13 python-tornado No fix yet —
Debian 12 python-tornado No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 python-tornado No fix yet —
Ubuntu 26.04 LTS python-tornado No fix yet —
Ubuntu 24.04 LTS python-tornado No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS python-tornado No fix yet —
Ubuntu Pro 20.04 LTS python-tornado No fix yet —
Ubuntu Pro 18.04 LTS python-tornado No fix yet —
Ubuntu Pro 16.04 LTS python-tornado No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python-tornado6 6.6-1.1 openSUSE-SU-2026:12440-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python-tornado No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling dask-kubernetes 2026.3.0-r21 —
Wolfi rolling mitmproxy 12.3.1-r3 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI tornado < 6.6 6.6 GHSA-pcg2-g6cj-q92c

Advisories 1

References