CVE-2026-116577

What it actually does

The HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, resulting in quadratic CPU consumption on the IOLoop thread before any application code executes.

Why it matters to the business

An unauthenticated remote attacker can exhaust CPU resources on the server process, blocking legitimate connections and causing denial of service with no data compromise or code execution.

How an attack unfolds

An unauthenticated client crafts an HTTP request containing a large number of obsolete line-folding header continuations sized to approach max_header_size; the server parses the headers on the IOLoop thread, triggering repeated string concatenations that consume excessive CPU and stall other connections.

How to fix it

Upgrade Tornado to version 6.6 or later; alternatively, place the service behind a reverse proxy that rejects or normalizes folded headers and enforces strict header size limits.

How to confirm the fix worked

Confirm the installed Tornado version is 6.6 or newer; test by sending a folded-header request and verifying that CPU usage remains linear rather than quadratic.

Typical attack path

1. Attacker connects to a Tornado-based HTTP server
2. Sends a single request whose headers contain many folded continuation lines
3. Server parser performs quadratic work before handing control to application handlers
4. IOLoop thread becomes CPU-bound, starving other clients

How to detect it

Inspect web server access logs for unusually long or repetitive header blocks; correlate with process CPU spikes on the Tornado IOLoop thread; look for requests that exceed normal header sizes but are accepted.

What your security team should do

• Immediately upgrade all Tornado deployments to 6.6 or newer
• Add WAF or proxy rules to drop or normalize obsolete line-folded headers
• Monitor for sudden CPU spikes on IOLoop threads serving Tornado processes
• Review downstream dependents and schedule upgrades according to ecosystem prevalence