Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

影響: pip:tornado < 6.6 → 6.6

Tornado's HTTP header parser takes quadratic time (O(n²)) when a header value is continued across many "obsolete line folding" (obs-fold) lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a large amount of CPU on the IOLoop thread and blocks every other connection that process is serving. This issue is closely related to CVE-2025-67725 (GHSA-c98p-7wgm-6p64). The fix for that advisory covered repeated headers but not line…

Read on GitHub Advisory Database

On 10/29/2026, 07:43 AM, GitHub Advisory Database published "Tornado: Quadratic CPU usage when parsing HTTP headers with line folding" (type: Advisory). Severity is "Medium" (medium). Related technologies: Python. CVE: CVE-2026-116577.