Technical impact
The vulnerability lies in Tornado’s HTTP header parser, which accepts obsolete line folding and repeatedly concatenates short continuation lines. This results in quadratic CPU consumption on the IOLoop thread. An unauthenticated attacker can send a crafted header block containing many continuation lines before the application code runs, blocking the event loop and preventing other connections from being served. The impact is limited to availability because the attacker can exhaust CPU resources, but no confidentiality or integrity is affected.
Affected Systems
Tornado, as provided by the Tornado web framework and asynchronous networking library under the vendor identifier tornadoweb:tornado, is vulnerable in all releases prior to version 6.6.0. The issue was fixed in release 6.6.0 and later. Therefore any installation of Tornado 6.5.x or earlier should be considered affected.
Risk and Exploitability
The CVSS base score of 5.3 indicates a moderate severity for availability. The EPSS score is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending malicious HTTP requests with many line‑folding continuations; no special privileges or authentication are required. Because the vulnerability consumes CPU resources on the event loop thread, successful exploitation results in a denial of service that can affect all connections handled by the application process.
Github GHSA