Tornado EUVD-2026-110318

No special conditions - remote unauthenticated exploitation against default configurations of any Tornado HTTP server; header parsing runs before application code, so no handler, route, or authentication is required (PR:N). The concrete trigger is a request header block containing many obsolete line-folding (obs-fold) continuation lines - header lines beginning with whitespace. Limiting factors: at the default max_header_size (64 KB) a single request only blocks the IOLoop for tens of milliseconds, so meaningful degradation requires repeated requests; impact grows with the square of header size, so severity is markedly higher only where an operator has raised max_header_size. Per the advisory, keeping or lowering max_header_size reduces (but does not eliminate) impact, and a reverse proxy that rejects or normalizes obs-fold before forwarding also limits exposure.

This is a real but modest-priority availability issue rather than a high-urgency emergency, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) correctly reflects a remote, unauthenticated, low-complexity attack that affects availability only - confidentiality and integrity are untouched, matching the vendor advisory and CWE-407 (inefficient algorithmic complexity). EPSS is low at 0.38% (32nd percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_month', not act_now or emergency. The one nuance the raw CVSS score hides is configuration dependence: the advisory states that at the default max_header_size (64 KB) a single request only blocks the IOLoop for tens of milliseconds (sustained impact requires many repeated requests), whereas with a raised max_header_size a single ~1 MB request can block the process for several seconds - so A:L is defensible for default deployments but real-world severity scales with operator configuration. No SSVC exploitation/automatable/technical-impact decision values were supplied in the input, so that framework cannot be cross-referenced here. Overall: patch on a normal maintenance cadence; this is not a drop-everything flaw, but it is trivially triggerable and worth closing, especially where max_header_size has been increased.

An unauthenticated attacker opens an HTTP connection to any Tornado server and sends a request whose header block consists mostly of short 'obsolete line folding' (obs-fold) continuation lines. Because header parsing runs on the IOLoop thread before any application or authentication code, the quadratic concatenation consumes CPU and stalls every other connection that process is serving; repeated requests (or a single large one where max_header_size is raised) degrade or block the service. No public exploit was identified at time of analysis, though the mechanism is fully described in the GHSA advisory and the fixing PR.