GHSA-c98p-7wgm-6p64

The HTTPHeaders.add method in Tornado accumulates values using string concatenation when the same header name is repeated. Due to Python string immutability, each concatenation copies the entire string, resulting in O(n²) time complexity.

Given Tornado's single event loop architecture, a single maliciously crafted HTTP request can block the server's event loop for an extended period, causing a Denial of Service (DoS).

Severity: High if max_header_size has been increased from its default, low if it has its default value of 64KB.

Database specific

{
    "cwe_ids": [
        "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T18:57:34Z",
    "nvd_published_at": "2025-12-12T06:15:41Z",
    "severity": "HIGH"
}

References

Affected packages

PyPI / tornado

Package

Name: tornado; View open source insights on deps.dev
Purl: pkg:pypi/tornado

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.5.3

Affected versions

0.*

0.2

1.*

1.0

1.1

1.1.1

1.2

1.2.1

2.*

2.0

2.1

2.1.1

2.2

2.2.1

2.3

2.4

2.4.1

3.*

3.0

3.0.1

3.0.2

3.1

3.1.1

3.2

3.2.1

3.2.2

4.*

4.0

4.0.1

4.0.2

4.1b2

4.1

4.2b1

4.2

4.2.1

4.3b1

4.3b2

4.3

4.4b1

4.4

4.4.1

4.4.2

4.4.3

4.5b1

4.5b2

4.5

4.5.1

4.5.2

4.5.3

5.*

5.0a1

5.0b1

5.0

5.0.1

5.0.2

5.1b1

5.1

5.1.1

6.*

6.0a1

6.0b1

6.0

6.0.1

6.0.2

6.0.3

6.0.4

6.1b1

6.1b2

6.1

6.2b1

6.2b2

6.2

6.3b1

6.3

6.3.1

6.3.2

6.3.3

6.4b1

6.4

6.4.1

6.4.2

6.5b1

6.5

6.5.1

6.5.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-c98p-7wgm-6p64/GHSA-c98p-7wgm-6p64.json"