Multiple security vulnerabilities have been identified in Tornado, an HTTP server and web framework. The issues affect Tornado versions earlier than 6.6 and involve HTTP header parsing, redirect handling, and chunked request body processing. They can allow unauthenticated attackers to cause denial of service or redirect users to attacker-controlled destinations, with availability and integrity risks depending on the flaw. The overall risk is moderate to low, with the most significant impact being service disruption.
CVE-2026-116577 (CVSS 5.3 — Medium): The HTTP header parser can take quadratic time when a header value is continued across many obsolete line-folding lines. An unauthenticated remote attacker can send such a request to block the event loop and degrade service for other connections.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Tornado, an HTTP server and web framework. The issues affect Tornado versions earlier than 6.6 and involve HTTP header parsing, redirect handling, and chunked request body processing. They can allow unauthenticated attackers to cause denial of service or redirect users to attacker-controlled destinations, with availability and integrity risks depending on the flaw. The overall risk is moderate to low, with the most significant impact being service disruption.
CVE-2026-116577 (CVSS 5.3 — Medium): The HTTP header parser can take quadratic time when a header value is continued across many obsolete line-folding lines. An unauthenticated remote attacker can send such a request to block the event loop and degrade service for other connections.[emaillocker id="1283"]
CVE-2025-67725: A related Tornado HTTP header parsing issue involving repeated headers, where crafted repeated headers could be processed before application code runs. An unauthenticated remote attacker could send such input to the affected parser.
CVE-2026-116578 (CVSS 2.1 — Low): The redirect handler can build a target from request path substitutions in a way that allows an attacker to change the redirect destination. An unauthenticated remote attacker can craft a request that produces a protocol-relative or host-changing redirect, enabling phishing.
CVE-2026-115927 (CVSS 5.3 — Medium): The HTTP body reader can process many small chunked transfer encoding chunks without yielding to the event loop, causing blocking and excessive memory use. An unauthenticated remote attacker can send a body made of many tiny chunks to degrade service, and the asynchronous HTTP client can be affected when reading a malicious response.
These vulnerabilities collectively present a risk of service disruption and user redirection for deployments that expose the affected HTTP processing to untrusted input. Operators of internet-facing services are most at risk. They should prioritize review of affected components.
We recommend you to update Tornado to version 6.6.
The following reports contain further technical details:
[/emaillocker]