CVE-2026-116577

Name	CVE-2026-116577
Description	Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1152300

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-tornado (PTS)	bookworm, bookworm (security)	6.2.0-3+deb12u4	vulnerable
	trixie (security), trixie	6.4.2-3+deb13u2	vulnerable
	forky, sid	6.5.5-5	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
python-tornado	source	(unstable)	(unfixed)			1152300

Notes

https://github.com/tornadoweb/tornado/security/advisories/GHSA-pcg2-g6cj-q92c
https://github.com/tornadoweb/tornado/pull/3765
Fixed by: https://github.com/tornadoweb/tornado/commit/1b7a1dc9f340f52de929852e8125aa12f25297c9 (v6.6.0b1)