Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
影響: pip:tornado < 6.6 → 6.6
Tornado's HTTP header parser takes quadratic time (O(n²)) when a header value is continued across many "obsolete line folding" (obs-fold) lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a large amount of CPU on the IOLoop thread and blocks every other connection that process is serving. This issue is closely related to CVE-2025-67725 (GHSA-c98p-7wgm-6p64). The fix for that advisory covered repeated headers but not line…
X에서 속보 받기악용·대형 유출·장애를 대응 방법과 함께.
팔로우 @vulnpulse_app| CVE | CVE-2026-116577 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 29. 오전 09:48 |
| 데이터 | Markdown JSON |
2026. 10. 29. 오전 07:43, GitHub Advisory Database에서 "Tornado: Quadratic CPU usage when parsing HTTP headers with line folding"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python. CVE: CVE-2026-116577.