CVE-2026-116577: 
Python vulnerability analysis and mitigation

CVE-2026-116577 is a denial-of-service vulnerability in the Tornado Python web framework caused by quadratic CPU consumption during HTTP header parsing with obsolete line folding (obs-fold). All versions of Tornado prior to 6.6 are affected. An unauthenticated remote attacker can send crafted HTTP requests with many continuation lines to exhaust CPU on the IOLoop thread, blocking all other connections served by the process. The vulnerability was published on October 26, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Feedly).

The root cause is an inefficient O(n²) algorithm in Tornado's HTTP header parser (tornado/httputil.py) that accepts obsolete line folding as defined in legacy HTTP specifications (CWE-407: Inefficient Algorithmic Complexity; CWE-770: Allocation of Resources Without Limits or Throttling). When a header value is split across many short continuation lines beginning with whitespace, the parser repeatedly concatenates each line onto the previous value, resulting in quadratic CPU growth relative to the number of continuation lines. Because header parsing occurs before any application code runs, no authentication or specific handler is required to trigger the issue. The severity scales with the max_header_size setting: at the default 64 KB, each malicious request can block the event loop for tens of milliseconds; with a raised limit (e.g., 1 MB), a single request can block the process for several seconds. This issue is closely related to CVE-2025-67725, which addressed repeated headers but not line-folded continuations (GitHub Advisory, Fix Commit).

Exploitation exclusively affects availability — confidentiality and integrity are not impacted. An unauthenticated attacker can degrade or deny service to all connections handled by the affected Tornado process by repeatedly sending crafted requests, as the single-threaded IOLoop is blocked during header parsing. The impact is amplified when operators have increased max_header_size beyond the default, potentially allowing a single request to stall the server for several seconds (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The CVE status is listed as "Deferred" and the EPSS score is 0.0, indicating very low current exploitation probability (Feedly). The vulnerability is trivially exploitable by any unauthenticated network attacker without special tools, as it only requires crafting an HTTP request with many whitespace-prefixed continuation header lines. It is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Identify target: Locate a publicly accessible service running Tornado versions prior to 6.6 (e.g., via Shodan or Censys searches for Tornado server banners).
2. Craft malicious HTTP request: Construct an HTTP request whose header block contains a single header followed by a large number of short continuation lines beginning with a tab or space character (obsolete line folding, per legacy RFC 2616 / obs-fold syntax). For example:

GET / HTTP/1.1
Host: target.example.com
X-Folded: start
 <continuation1>
 <continuation2>
 ... (hundreds or thousands of lines)

3. Send request: Transmit the crafted request to the target server using any HTTP client (e.g., curl, netcat, or a custom Python script).
4. Repeat for sustained DoS: Send requests in a loop to continuously block the IOLoop thread, preventing legitimate connections from being processed.
5. Scale impact: If max_header_size is elevated on the target, fewer requests are needed to cause multi-second event loop stalls (GitHub Advisory).

• Network: Unusual HTTP requests with headers containing many whitespace-prefixed continuation lines (obs-fold format); high volume of requests to any endpoint from a single source IP with abnormally large header blocks.
• Logs: Tornado access logs showing requests with oversized or malformed headers; elevated response latency or timeouts logged for legitimate clients coinciding with suspicious requests.
• Process: Sustained high CPU utilization on the Tornado process (IOLoop thread) without a corresponding increase in legitimate traffic; event loop lag metrics spiking during receipt of specific requests.

Upgrade to Tornado 6.6.0, which removes support for obsolete line folding entirely — header lines beginning with whitespace are now rejected with an HTTPInputError (Tornado Release, Fix Commit). If immediate upgrade is not possible, two workarounds can reduce impact: (1) keep max_header_size at its default value (64 KB) or lower it to limit the quadratic cost per request; (2) deploy Tornado behind a reverse proxy (e.g., nginx, HAProxy) configured to reject or normalize obsolete line folding before forwarding requests (GitHub Advisory).

The vulnerability was reported by researcher @manus-pi and addressed by Tornado maintainer @bdarnell, who noted that obsolete line folding "is no longer used in practice" and that supporting it "adds complexity and risk of DoS via quadratic performance on malicious data" (PR #3765). The fix was expedited ahead of the originally planned Tornado 7.0 removal schedule due to the DoS risk (Tornado Release). No significant broader media coverage or social media discussion has been identified at this time.