{"id":"ghsa-ghsa-pcg2-g6cj-q92c","seq":2056906,"kind":"advisory","title":"Tornado: Quadratic CPU usage when parsing HTTP headers with line folding","url":"https://github.com/advisories/GHSA-pcg2-g6cj-q92c","permalink":"https://vulnpulse.app/items/ghsa-ghsa-pcg2-g6cj-q92c","summary":"影響: pip:tornado < 6.6 → 6.6\nTornado's HTTP header parser takes quadratic time (O(n²)) when a header value is continued across many \"obsolete line folding\" (obs-fold) lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a large amount of CPU on the IOLoop thread and blocks every other connection that process is serving. This issue is closely related to CVE-2025-67725 (GHSA-c98p-7wgm-6p64). The fix for that advisory covered repeated headers but not line…","severity":"medium","techs":["python"],"cves":["CVE-2026-116577"],"tags":["GHSA-pcg2-g6cj-q92c","tornado"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T22:43:41.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}