Repository navigation
Update dependency tornado to v6.6 [SECURITY] - #1104
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
6.5.9→6.6Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
CVE-2026-116577 / GHSA-pcg2-g6cj-q92c
More information
Details
Summary
Tornado's HTTP header parser takes quadratic time (O(n²)) when a header value is continued across many "obsolete line folding" (obs-fold) lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a large amount of CPU on the IOLoop thread and blocks every other connection that process is serving.
This issue is closely related to CVE-2025-67725 (GHSA-c98p-7wgm-6p64). The fix for that advisory covered repeated headers but not line-folded continuations.
Impact
All Tornado HTTP servers are affected. Header parsing runs before any application code, so no authentication or particular handler is required.
How bad it gets depends on
max_header_size:max_header_size: the cost grows with the square of the header size. A single 1 MB request can block the process for several seconds.Only availability is affected. Confidentiality and integrity are not.
Patches
Fixed in Tornado 6.6 by removing support for obsolete line folding completely; header lines that begin with whitespace are now rejected.
Workarounds
max_header_sizeat its default value or lower it. This limits the impact but doesn't remove it.Credit
Reported by @manus-pi.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Tornado: Open redirect in RedirectHandler via protocol-relative URLs
CVE-2026-116578 / GHSA-pw9p-v7r6-gx4p
More information
Details
Summary
tornado.web.RedirectHandlerbuilds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the application's domain, which can be used in phishing.Impact
Applications are affected if they use
RedirectHandlerwith a URL template where a regex capture group can influence the scheme or host of the redirect. This includes:(r"/(.*)/target", RedirectHandler, {"url": "/{0}/destination"}). A request tohttps://example.com//evil.com/targetredirects to//evil.com/destination, a protocol-relative URL pointing to evil.com. Variants using backslashes or encoded characters have the same effect, because browsers treat them as equivalent to//.(r"/old(.*)", RedirectHandler, {"url": "https://new.example.com{0}"}). A request to/old.evil.com/or/old@evil.com/redirects to evil.com."{0}"), which can be given an absolute URL.Applications are not affected if their
RedirectHandlertemplates use only static URLs, or if every substitution comes after a fixed host and a/(for example"/static/{0}"or"https://example.com/{0}"). Other uses ofRequestHandler.redirect()are not affected by this advisory, although applications that pass user-controlled input toredirect()should validate it themselves.Patches
Fixed in Tornado 6.6.
RedirectHandlernow returns a 400 error if the substituted values would change the scheme or host of the redirect from what the template specifies. As a result, substitutions can no longer be used in the scheme or host part of a template. The similar check inStaticFileHandlerhas also been hardened against backslash and whitespace variants.Workarounds
RedirectHandlertemplates so every substitution comes after a fixed prefix ending in/, or write capture-group regexes that cannot match characters such as/,\,@,.or:where they could affect the host.RedirectHandlerwith a custom handler that validates the target before callingself.redirect().Credit
Reported by Longwei Wang (@gn00295120).
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
CVE-2026-115927 / GHSA-r4j5-9xpp-3985
More information
Details
Summary
When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop (and therefore every other connection served by that process) for the entire time it takes to parse the body. A body near the default
max_body_sizeof 100 MB can block the process for close to a minute, and the attacker can repeat or parallelize these requests.Bodies made of tiny chunks also consumed far more memory than their size: a handler that does not use
@stream_request_bodystored each chunk as a separate object, using roughly 20 times as much memory as the bytes received.Impact
All Tornado HTTP servers are affected when they receive a request body for a handler that reads it, which includes any handler that does not reject the request before the body is read. No authentication is required. Lowering
max_body_sizereduces the maximum blocking time and memory use for each request but does not remove the issue.SimpleAsyncHTTPClientis affected in the same way when it reads a response from a malicious server.Patches
Fixed in Tornado 6.6. Tornado now yields to the event loop periodically while reading any body, combines small chunks before passing them to
data_received, and stores non-streaming bodies more compactly.Applications using
@stream_request_bodyshould note that the pieces passed todata_receivedno longer correspond to HTTP chunk boundaries.Workarounds
Content-Lengthheader instead of chunked encoding.max_body_size(for the whole server or for individual handlers) to limit the impact of each request.Credit
Reported by uttej-badwane.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
tornadoweb/tornado (tornado)
v6.6Compare Source
v6.5.10Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.