Inefficient Algorithmic Complexity in Tornado - CVE-2026-116577
Published: November 9, 2026
Vulnerability identifier: #VU162934
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116577
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to degrade Tornado HTTP service by consuming CPU and blocking other connections served by the same process.
The vulnerability exists due to quadratic processing time in Tornado's HTTP header parser when a header value spans many obsolete line-folded continuation lines. An unauthenticated remote attacker can send repeated requests containing these lines to stall the event loop without authentication or victim interaction.
Affected software
Tornado
openEuler
python-tornado
python-tornado-debuginfo
python-tornado-debugsource
python3-tornado
python-tornado-help
openEuler
python-tornado
python-tornado-debuginfo
python-tornado-debugsource
python3-tornado
python-tornado-help
How to mitigate CVE-2026-116577
Install security update from vendor's website.
Tornado - update to 6.6.0
python-tornado - update to 6.6-1
python-tornado-debuginfo - update to 6.6-1
python-tornado-debugsource - update to 6.6-1
python3-tornado - update to 6.6-1
python-tornado-help - update to 6.6-1
python-tornado - update to 6.6-1
python-tornado-debuginfo - update to 6.6-1
python-tornado-debugsource - update to 6.6-1
python3-tornado - update to 6.6-1
python-tornado-help - update to 6.6-1