What is CVE-2026-116577?

CVE-2026-116577 is a medium-severity vulnerability in Tornadoweb Tornado, classified under Inefficient Algorithmic Complexity. CVSS score: 5.3/10. Published 2026-10-26.

How severe is CVE-2026-116577?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Resource exhaustion in Tornadoweb Tornado

CVE-2026-116577

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.

Published 2026-10-26 · last modified 2026-10-26.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Tornadoweb Tornado — versions < 6.6

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-116577?: CVE-2026-116577 is a medium-severity vulnerability in Tornadoweb Tornado, classified under Inefficient Algorithmic Complexity. CVSS score: 5.3/10. Published 2026-10-26.
How severe is CVE-2026-116577?: Medium severity. CVSS v3 base score is 5.3 out of 10.