Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

影響: pip:tornado < 6.6 → 6.6

Tornado's HTTP header parser takes quadratic time (O(n²)) when a header value is continued across many "obsolete line folding" (obs-fold) lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a large amount of CPU on the IOLoop thread and blocks every other connection that process is serving. This issue is closely related to CVE-2025-67725 (GHSA-c98p-7wgm-6p64). The fix for that advisory covered repeated headers but not line…

GitHub Advisory Databaseで読む

2026/10/29 07:43、GitHub Advisory Databaseが「Tornado: Quadratic CPU usage when parsing HTTP headers with line folding」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Python。CVE: CVE-2026-116577。