Skip to content
Fencer Vulns
medium 5.3

CVE-2026-116577 json

Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

published 2026-10-26 13 d ago modified 2026-10-31 9 d ago also GHSA-pcg2-g6cj-q92c , EUVD-2026-110318

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 32%
public exploits
0
none known

Summary

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.

Patch / fix

  • pypi tornado 6.6
  • python-tornado6 openSUSE Tumbleweed 6.6-1.1

opensuse advisories openSUSE-SU-2026:12440-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-116577 updated cvss 5.3

tornado: tornado: Denial of Service via obsolete HTTP header line folding

  • Red Hat Lightspeed Core lightspeed-core/rag-tool-cpu-rhel9, lightspeed-core/lightspeed-stack-rhel9, lightspeed-core/rag-tool-cuda-12.9-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-ocp-rag-rhel9 Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/lightspeed-chatbot-rhel9, ansible-automation-platform-27/lightspeed-chatbot-rhel9 Red Hat Enterprise Linux 8 pcs, pcs-snmp Red Hat Enterprise Linux 9 python3-tornado, python-tornado 6.5.8-0.el10_0.1 Red Hat Enterprise Linux 10 python-tornado 6.5.8-0.el10_0.1
    +4 more products
    Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-feature-server-rhel9, rhoai/odh-llama-stack-core-rhel9, rhoai/odh-th-torch-cpu-py312-rhel9, rhoai/odh-th-torch-cuda-py312-rhel9, rhoai/odh-th-torch-rocm-py312-rhel9, rhoai/odh-th06-cpu-torch210-py312-rhel9, +23 more Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-9, python-flit 3.9.0-3.1.el9ocp, python-pep517 0.13.0-5.2.el9ocp, python-tornado 6.5.8-0.el10_0.1 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
    affected: no fix available “Fix deferred”
  • Red Hat OpenStack Platform 16.2 rhosp-rhel8/openstack-redis, rhosp-rhel8/openstack-haproxy, rhosp-rhel8/openstack-mariadb, rhosp-rhel8/openstack-rabbitmq, rhosp-rhel8/openstack-ovn-northd, rhosp-rhel8/openstack-manila-share, +2 more
    affected: no fix planned “Out of support scope”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
9 d ago

Exploit prediction

0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
pypi tornado
<6.6
6.6

Affected products

  • tornadoweb tornado

Classification

Weakness
  • CWE-407 Inefficient Algorithmic Complexity
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.