Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

影響: pip:tornado < 6.6 → 6.6

Tornado's HTTP header parser takes quadratic time (O(n²)) when a header value is continued across many "obsolete line folding" (obs-fold) lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a large amount of CPU on the IOLoop thread and blocks every other connection that process is serving. This issue is closely related to CVE-2025-67725 (GHSA-c98p-7wgm-6p64). The fix for that advisory covered repeated headers but not line…

在 GitHub Advisory Database 阅读

2026/10/29 07:43，GitHub Advisory Database 发布了“Tornado: Quadratic CPU usage when parsing HTTP headers with line folding”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Python。CVE：CVE-2026-116577。