CVE-2026-116577

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.

• CWE-407
• CWE-770

• https://github.com/tornadoweb/tornado/commit/1b7a1dc9f340f52de929852e8125aa12f25297c9
• https://github.com/tornadoweb/tornado/pull/3765
• https://github.com/tornadoweb/tornado/releases/tag/v6.6.0
• https://github.com/tornadoweb/tornado/security/advisories/GHSA-pcg2-g6cj-q92c

Published

Oct 26, 2026

Last Modified

Oct 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116556A vulnerability was found in Argilla up to 2.8.0. This affec…2.4
• CVE-2026-11656Use after free in ServiceWorker in Google Chrome prior to 14…8.3
• CVE-2026-116566socket.getaddrinfo() previously accepted null bytes within *…5.3
• CVE-2026-11657Use after free in Payments in Google Chrome on Mac prior to …8.8
• CVE-2026-116575Mem0 provides persistent memory infrastructure for AI agents…6.3
• CVE-2026-116576systeminformation is a System and OS information library for…7.8
• CVE-2026-116578Tornado is a Python web framework and asynchronous networkin…2.1
• CVE-2026-116579Autobahn Python is a WebSocket and WAMP implementation for P…5.9
• CVE-2026-11658Insufficient validation of untrusted input in Extensions in …6.5
• CVE-2026-116580Seroval facilitates JavaScript value stringification, includ…7.3
• CVE-2026-116581Seroval facilitates JavaScript value stringification, includ…7.5
• CVE-2026-116582Seroval facilitates JavaScript value stringification, includ…4.7