## Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

- 種別: advisory
- 重大度: medium
- 関連技術: python
- CVE: CVE-2026-116577
- 公開日時: 2026-10-28T22:43:41.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-pcg2-g6cj-q92c)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-pcg2-g6cj-q92c

影響: pip:tornado < 6.6 → 6.6
Tornado's HTTP header parser takes quadratic time (O(n²)) when a header value is continued across many "obsolete line folding" (obs-fold) lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a large amount of CPU on the IOLoop thread and blocks every other connection that process is serving. This issue is closely related to CVE-2025-67725 (GHSA-c98p-7wgm-6p64). The fix for that advisory covered repeated headers but not line…