Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same header name is repeated, causing a Denial of Service (DoS). Due to Python string immutability, each concatenation copies the entire string, resulting in O(n²) time complexity. The severity can vary from high if max_header_size has been increased from its default, to low if it has its default value of 64KB. This issue is fixed in version 6.5.3.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pcs-snmpUpgrade pcs | Jan 26, 2026 | Jan 21, 2026 |
| Alpine Linux | — | Upgrade py3-tornado | Jun 18, 2026 | Dec 12, 2025 |
| Amazon Linux Ami 2 | — | Upgrade python3-tornado-docUpgrade python3-tornadoUpgrade python-tornadoUpgrade python3-tornado-debuginfoUpgrade python-tornado-docUpgrade python-tornado-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade python3-tornadoUpgrade python3-tornado-debuginfoUpgrade python3.13-tornado-debuginfoUpgrade python3.13-tornado-docUpgrade python-tornado-debugsourceUpgrade python3.13-tornadoUpgrade python3.13-tornado-debugsourceUpgrade python-tornado-doc | Jan 12, 2026 | Dec 12, 2025 |
| Debian | — | Upgrade python-tornado | Feb 2, 2026 | Feb 2, 2026 |
| Oracle_linux | — | Upgrade pcs-snmpUpgrade pcs | Jan 23, 2026 | Dec 12, 2025 |
| Redhat_linux | — | No solution existsUpgrade pcs-snmpUpgrade pcs | Jan 22, 2026 | Dec 12, 2025 |
| Rocky_linux | — | Upgrade pcsUpgrade pcs-snmp | Jan 26, 2026 | Jan 23, 2026 |
| Ubuntu | — | Upgrade python3-tornado (Ubuntu Pro)Upgrade python3-tornadoUpgrade python-tornado (Ubuntu Pro) | Jan 9, 2026 | Dec 12, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub