CVE-2026-116577: Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

Severity: medium. ### Summary Tornado's HTTP header parser takes quadratic time (O(n²)) when a header value is continued across many "obsolete line folding" (obs-fold) lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a large amount of CPU on

Читать первоисточник →