CVE-2026-116577 tornadoweb CVE debrief

Who should care

Defenders responsible for Tornado-based systems should assess their exposure and prioritize upgrading to Tornado 6.6 or applying compensating controls to mitigate the impact of this vulnerability.

Why it matters

This vulnerability affects all Tornado HTTP servers and can cause quadratic CPU usage when parsing HTTP headers with line folding. Defenders should prioritize upgrading to Tornado 6.6 or applying compensating controls to mitigate the impact of this vulnerability on their systems.

• Degradation of service due to increased CPU usage
• Potential for denial of service (DoS) attacks
• Need for verification of `max_header_size` setting
• Importance of upgrading to Tornado 6.6 or applying compensating controls

Technical summary

The Tornado HTTP header parser takes quadratic time (O(n²)) when a header value is continued across many 'obsolete line folding' (obs-fold) lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines, causing a large amount of CPU usage on the IOLoop thread and blocking every other connection that the process is serving. This issue affects all Tornado HTTP servers and can cause significant performance degradation. Upgrading to Tornado 6.6 or applying compensating controls can mitigate the impact of this vulnerability.

Defensive priority

Defenders should prioritize upgrading to Tornado 6.6 or applying compensating controls to mitigate the impact of this vulnerability on their systems.

Recommended defensive actions

• Upgrade to Tornado 6.6 or later
• Apply compensating controls to mitigate the impact of this vulnerability
• Monitor for suspicious HTTP requests
• Consider reducing `max_header_size` to limit the impact of this vulnerability
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The evidence for this vulnerability comes from the Tornado security advisory and the CVE Program record. The advisory provides detailed information about the vulnerability, its impact, and the fix. However, the evidence is limited to the information provided in the advisory and the CVE record, and further verification may be necessary to fully understand the scope and impact of this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.