CVE-2025-54309

CVE-2025-54309 CrushFTP Authentication Bypass Overview CVE-2025-54309 is an authentication bypass vulnerability in CrushFTP that allows unauthorized administrative user creation through AS2 header manipulation. Technical Details Vulnerability Location File : crushftp/server/ServerSessionHTTP.java...

Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

Summary Tornado's HTTP header parser takes quadratic time On² when a header value is continued across many "obsolete line folding" obs-fold lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a large amount of CPU on the...

GHSA-PCG2-G6CJ-Q92C Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

Summary Tornado's HTTP header parser takes quadratic time On² when a header value is continued across many "obsolete line folding" obs-fold lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a large amount of CPU on the...

EUVD-2026-110318

Tornado: Quadratic CPU usage when parsing HTTP headers with line folding...

CVE-2026-118372

LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host copies the path without rejecting control characters and httpopen places it in the POST request...

CVE-2026-118372 LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path

LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host copies the path without rejecting control characters and httpopen places it in the POST request...

CVE-2026-118372

LibreSSL ocspcheck versions through 4.4.0 are vulnerable to a CRLF injection vulnerability. The issue exists because the url2host() function copies the URI path without rejecting control characters, while http_open() subsequently includes this path in the POST request line. An attacker can exploi...

CVE-2026-118371: OpenBSD LibreSSL: LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url()…

LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSPsendreqnew and OCSPparseurl functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information...

CVE-2026-116577

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a head...

SUSE CVE-2026-115877

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF...

Linux Distros Unpatched Vulnerability : CVE-2026-116577

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly...

DEBIAN-CVE-2026-116577

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a head...

CVE-2026-116577

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a head...

CVE-2026-116577

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a head...

UBUNTU-CVE-2026-116577

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a head...

CVE-2025-60876

CVE-2025-60876: busybox wget request-target injection fix A behavior-preserving fix for CVE-2025-60876, an HTTP header-injection vulnerability in BusyBox wget, plus the proof-of-concept that demonstrates it and the artifacts for submitting the fix upstream to BusyBox. The vulnerability BusyBox wg...

CVE-2026-116577 Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a head...

CVE-2026-116577

The Python web framework Tornado is vulnerable to quadratic CPU consumption in versions prior to 6.6 . The issue resides in the HTTP header parser , which accepts obsolete line folding and repeatedly concatenates short continuation lines. This allows an unauthenticated client to block the IOLoop ...

CVE-2026-116577 Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a head...

CVE-2026-116577

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a head...