CVE-2025-67725High· 7.5▾ TwilightTornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method.…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
0.5% → 0.6%
Last analysed / modified upstream
Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same header name is repeated, causing a Denial of Service (DoS). Due to Python string immutability, each concatenation copies the entire string, resulting in O(n²) time complexity. The severity can vary from high if max_header_size has been increased from its default, to low if it has its default value of 64KB. This issue is fixed in version 6.5.3.
tornado < 6.5.3Upgrade past the affected range:
tornado 6.5.3Affected packages:
tornado < 6.5.3Patched in:
tornado 6.5.3Source: https://osv.dev/vulnerability/PYSEC-2025-266
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-67726High· 7.5Tornado is a Python web framework and asynchronous networking library
CVE-2026-82397High· 7.5Tornado is a Python web framework and asynchronous networking library
CVE-2025-67724Medium· 5.4Tornado is a Python web framework and asynchronous networking library
CVE-2024-14029High· 7.5Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request
CVE-2026-31958High· 7.5Tornado is a Python web framework and asynchronous networking library
CVE-2026-103262High· 7.5Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response