CVE-2025-67725

NameCVE-2025-67725
DescriptionTornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same header name is repeated, causing a Denial of Service (DoS). Due to Python string immutability, each concatenation copies the entire string, resulting in O(n²) time complexity. The severity can vary from high if max_header_size has been increased from its default, to low if it has its default value of 64KB. This issue is fixed in version 6.5.3.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1122661

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python-tornado (PTS)bullseye6.1.0-1vulnerable
bullseye (security)6.1.0-1+deb11u2vulnerable
bookworm, bookworm (security)6.2.0-3+deb12u2vulnerable
trixie6.4.2-3vulnerable
forky, sid6.5.2-3vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python-tornadosource(unstable)(unfixed)1122661

Notes

https://github.com/tornadoweb/tornado/security/advisories/GHSA-c98p-7wgm-6p64
Fixed by: https://github.com/tornadoweb/tornado/commit/771472cfdaeebc0d89a9cc46e249f8891a6b29cd (v6.5.3)

Search for package or bug name: Reporting problems