Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Tornado Python web framework and asynchronous networking library is affected, specifically its HTTP header parsing. An unauthenticated remote client can send a request with many obsolete line-folded header continuations, causing excessive CPU use that can stall other connections handled by the same process, resulting in denial of service.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- tornadoweb tornado
fixed in 6.6
- tornadoPyPI
fixed in 6.6