vulnerability / NVI-00009111 / Revision 1
Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
GitHub lists this reviewed advisory for tornado. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.
This report has not inspected your inventory, configuration, deployed build, reachability or evidence. A catalog listing and a severity score do not establish exposure or compromise.
01 / Meaning
Why it matters
Published affected context helps an owner decide what evidence to gather. This report has not examined your application.
5.3 medium
GitHub source severity; exploitability and local consequence require separate evidence.
As of · GitHub Advisory Database
02 / Applicability
The affected context
Affected versions, configuration prerequisites and known exclusions are public. Confirm each one against the deployed service.
tornado
source listed< 6.6
### Summary Tornado's HTTP header parser takes quadratic time (O(n²)) when a header value is continued across many "obsolete line folding" (obs-fold) lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a large amount of CPU on the IOLoop thread and blocks every other connection that process is serving. This issue is closely related to CVE-2025-67725 (GHSA-c98p-7wgm-6p64). The fix for that advisory covered repeated headers but not line-folded continuations. ### Impact All Tornado HTTP servers are affected. Header parsing runs before any application code, so no authentication or particular handler is required. How bad it gets depends on `max_header_size`: - **Default (64 KB):** each malicious request blocks the event loop for tens of milliseconds. Repeated requests can degrade service. - **Raised `max_header_size`:** the cost grows with the square of the header size. A single 1 MB request can block the process for several seconds. Only availability is affected. Confidentiality and integrity are not. ### Patches Fixed in Tornado 6.6 by removing support for obsolete line folding completely; header lines t
03 / Response
What to do next
- investigate
Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.
Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system. GitHub Advisory Database
A fixed release is not deployment evidence.
Check current vendor support and compatibility. After making a change, verify the deployed build and relevant runtime conditions. Keep the evidence, owner and time. An updated lockfile alone does not prove what is running.
04 / Limits
What this report cannot establish
- Customer inventory, deployment, reachability and exploitation have not been inspected.
05 / Provenance
Sources you can inspect
Each assertion retains its source. Mirrored records may repeat one underlying publisher; additional links are not independent corroboration.
- GHSA-pcg2-g6cj-q92c ↗
GitHub Advisory Database · vendor advisory
Observed . GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.
Public revision history
Only published revisions appear here. Routine fetches do not create a material-change event.
- Revision 1 ·
First indexed by Null; source disclosure date is shown separately.