{"id":"CVE-2025-67725","title":"Tornado is a Python web framework and asynchronous networking library","summary":"Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method.…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-400"],"vendor":"tornadoweb","product":"tornado","affected":["tornado < 6.5.3"],"patched":["tornado 6.5.3"],"published":"2025-12-12","updated":"2026-10-07","sourceUpdated":"2026-10-07T20:10:01.970","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-67725","references":[{"url":"https://github.com/tornadoweb/tornado/commit/771472cfdaeebc0d89a9cc46e249f8891a6b29cd","label":"security-advisories@github.com"},{"url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.3","label":"security-advisories@github.com"},{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-c98p-7wgm-6p64","label":"security-advisories@github.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67725.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-67725"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2421722"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-67725"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67725"},{"url":"https://access.redhat.com/errata/RHSA-2026:0930"},{"url":"https://access.redhat.com/errata/RHSA-2026:2462"},{"url":"https://access.redhat.com/errata/RHSA-2026:2469"},{"url":"https://access.redhat.com/errata/RHSA-2026:2465"},{"url":"https://access.redhat.com/errata/RHSA-2026:2484"},{"url":"https://access.redhat.com/errata/RHSA-2026:2106"},{"url":"https://access.redhat.com/errata/RHSA-2026:3713"}],"tags":["nvd","osv","pip","csaf","vex","red-hat","score-dispute"],"epss":0.00559,"epssPercentile":0.46366,"aliases":["PYSEC-2025-266","GHSA-c98p-7wgm-6p64"],"ecosystem":"pip","ingestedAt":"2026-07-13T18:58:06.924Z","scores":{"nvd":7.5,"vendor":5.3},"slug":"CVE-2025-67725","body":"## Overview\n\nTornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same header name is repeated, causing a Denial of Service (DoS).  Due to Python string immutability, each concatenation copies the entire string, resulting in O(n²) time complexity. The severity can vary from high if max_header_size has been increased from its default, to low if it has its default value of 64KB. This issue is fixed in version 6.5.3.\n\n## Affected\n\n- `tornado < 6.5.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `tornado 6.5.3`\n\n## Package advisory (CVE-2025-67725)\n\nAffected packages:\n\n- `tornado < 6.5.3`\n\nPatched in:\n\n- `tornado 6.5.3`\n\nSource: https://osv.dev/vulnerability/PYSEC-2025-266\n\n## Vendor advisories\n\n- **RHSA-2026:0930** · Red Hat · fixed in: Red Hat Enterprise Linux HighAvailability (v. 8), Red Hat Enterprise Linux ResilientStorage (v. 8) · released 2026-01-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:0930)\n- **RHSA-2026:2462** · Red Hat · fixed in: Red Hat Enterprise Linux High Availability AUS (v.8.4), Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) · released 2026-02-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:2462)\n- **RHSA-2026:2469** · Red Hat · fixed in: Red Hat Enterprise Linux High Availability E4S (v.8.6), Red Hat Enterprise Linux High Availability TUS (v.8.6) · released 2026-02-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:2469)\n- **RHSA-2026:2465** · Red Hat · fixed in: Red Hat Enterprise Linux High Availability E4S (v.8.8), Red Hat Enterprise Linux High Availability TUS (v.8.8) · released 2026-02-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:2465)\n- **RHSA-2026:2484** · Red Hat · fixed in: Red Hat Enterprise Linux High Availability E4S (v.9.0), Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) · released 2026-02-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:2484)\n- **RHSA-2026:2106** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-02-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:2106)\n- **RHSA-2026:3713** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-03-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:3713)\n- **Red Hat VEX** · Moderate · affected: external secrets operator for Red Hat OpenShift - Tech Preview, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux AI (RHEL AI) 3 · no fix planned: external secrets operator for Red Hat OpenShift - Tech Preview, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67725.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}