CVE-2026-116577 Details

A denial-of-service vulnerability has been identified in Tornado, a Python web framework, in versions prior to 6.6. The issue arises in the HTTP header parser, which improperly handles obsolete line folding by repeatedly concatenating short continuation lines. This behavior leads to quadratic CPU consumption on the IOLoop thread. An unauthenticated client can exploit this vulnerability by sending a header block with many continuation lines, causing increased CPU usage and blocking other connections served by the process. The impact is more severe with larger header sizes, as a 1 MB request can block the process for several seconds.

Users can upgrade to Tornado version 6.6.0, where this vulnerability has been fixed by removing support for obsolete line folding in the HTTP header parser. Alternatively, Tornado can be run behind a reverse proxy that normalizes or rejects obsolete line folding before forwarding requests.