CVE catalog
CVE-2026-116577
python-tornado: CVE-2026-116577
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.38% · Oct 27, 2026
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | python-tornado | sid | 6.5.5-5 | vulnerable |
| Debian | python-tornado | forky | 6.5.5-5 | vulnerable |
| Debian | python-tornado | trixie | 6.4.2-3+deb13u2 | vulnerable |
| Debian | python-tornado | trixie-security | 6.4.2-3+deb13u2 | vulnerable |
| Debian | python-tornado | bookworm | 6.2.0-3+deb12u4 | vulnerable |
| Debian | python-tornado | bookworm-security | 6.2.0-3+deb12u4 | vulnerable |
| Ubuntu | python-tornado | pro | 6.1.0-1build1 | vulnerable |
| Ubuntu | python-tornado | pro | 6.1.0-2 | vulnerable |
| Ubuntu | python-tornado | pro | 6.1.0-3 | vulnerable |
| Ubuntu | python-tornado | pro | 6.1.0-3build1 | vulnerable |
| Ubuntu | python-tornado | pro | 6.1.0-3ubuntu0.1~esm1 | vulnerable |
| Ubuntu | python-tornado | pro | 6.1.0-3ubuntu0.1~esm2 | vulnerable |
| Ubuntu | python-tornado | pro | 6.1.0-3ubuntu0.1~esm4 | vulnerable |
| Ubuntu | python-tornado | pro | 6.1.0-3ubuntu0.1~esm5 | vulnerable |
| Ubuntu | python-tornado | pro | 6.1.0-3ubuntu0.1~esm6 | vulnerable |
| Ubuntu | python-tornado | 24.04 | 6.3.2-1 | vulnerable |
| Ubuntu | python-tornado | 24.04 | 6.4.0-0ubuntu1 | vulnerable |
| Ubuntu | python-tornado | 24.04 | 6.4.0-1 | vulnerable |
| Ubuntu | python-tornado | 24.04 | 6.4.0-1build1 | vulnerable |
| Ubuntu | python-tornado | 24.04 | 6.4.0-1ubuntu0.1 | vulnerable |
| Ubuntu | python-tornado | 24.04 | 6.4.0-1ubuntu0.2 | vulnerable |
| Ubuntu | python-tornado | 24.04 | 6.4.0-1ubuntu0.4 | vulnerable |
| Ubuntu | python-tornado | 24.04 | 6.4.0-1ubuntu0.5 | vulnerable |
| Ubuntu | python-tornado | 24.04 | 6.4.0-1ubuntu0.6 | vulnerable |
| Ubuntu | python-tornado | 26.10 | 6.5.4-0.1 | vulnerable |
| Ubuntu | python-tornado | 26.10 | 6.5.5-2 | vulnerable |
| Ubuntu | python-tornado | 26.10 | 6.5.5-4 | vulnerable |
| Ubuntu | python-tornado | 26.10 | 6.5.5-5 | vulnerable |
| Ubuntu | python-tornado | 26.10 | 6.5.5-5ubuntu1.1 | vulnerable |
| Ubuntu | python-tornado | 26.04 | 6.4.2-3 | vulnerable |
| Ubuntu | python-tornado | 26.04 | 6.5.2-3 | vulnerable |
| Ubuntu | python-tornado | 26.04 | 6.5.4-0.1 | vulnerable |
| Ubuntu | python-tornado | 26.04 | 6.5.4-0.1ubuntu0.1 | vulnerable |
| Ubuntu | python-tornado | 26.04 | 6.5.4-0.1ubuntu0.2 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | python-tornado | source | sid | (unfixed) | not yet assigned | Not reported | [1152300] |
| Debian | python-tornado | source | forky | (unfixed) | not yet assigned | Not reported | [1152300] |
| Debian | python-tornado | source | trixie | (unfixed) | not yet assigned | Not reported | [1152300] |
| Debian | python-tornado | source | bookworm | (unfixed) | not yet assigned | Not reported | [1152300] |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [python3-tornado]Affected
Source package: [python-tornado]
Details (4)
6.2.0-3+deb12u4· amd64 · bookwormAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· arm64 · bookwormAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· amd64 · bookworm-securityAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· arm64 · bookworm-securityAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
- [python-tornado-doc]Affected
Source package: [python-tornado]
Details (4)
6.2.0-3+deb12u4· all · bookwormAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· all · bookwormAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· all · bookworm-securityAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· all · bookworm-securityAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
[Debian 13 (Trixie)]
- [python3-tornado]Affected
Source package: [python-tornado]
Details (4)
6.4.2-3+deb13u2· amd64 · trixieAffected
dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· arm64 · trixieAffected
dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· amd64 · trixie-securityAffected
dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· arm64 · trixie-securityAffected
dsa · python-tornado · debian · 13
- [python-tornado-doc]Affected
Source package: [python-tornado]
Details (4)
6.4.2-3+deb13u2· all · trixieAffected
dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· all · trixieAffected
dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· all · trixie-securityAffected
dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· all · trixie-securityAffected
dsa · python-tornado · debian · 13
Observed: