CVE-2026-116577

A flaw was found in Tornado. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending crafted HTTP requests containing many folded header continuation lines. Processing these lines requires quadratic computational effort, consuming excessive CPU resources on the server's event loop and blocking legitimate incoming connections.

This vulnerability is rated as Moderate severity because an unauthenticated remote client can induce high CPU utilization and temporarily stall event loop execution, impacting service availability without compromising data integrity or confidentiality. In standard enterprise environments, Red Hat services using Tornado are typically positioned behind reverse proxies or load balancers that normalize or strip obsolete line-folded headers before requests arrive at the backend daemon. Furthermore, while processing malformed multiline headers requires quadratic parsing effort, default header size boundaries limit the duration of event loop starvation under normal operational conditions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.