--- id: CVE-2025-67725 title: Tornado is a Python web framework and asynchronous networking library summary: >- Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method.… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-400 vendor: tornadoweb product: tornado affected: - tornado < 6.5.3 patched: - tornado 6.5.3 published: '2025-12-12' updated: '2026-10-07' sourceUpdated: '2026-10-07T20:10:01.970' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-67725' references: - url: >- https://github.com/tornadoweb/tornado/commit/771472cfdaeebc0d89a9cc46e249f8891a6b29cd label: security-advisories@github.com - url: 'https://github.com/tornadoweb/tornado/releases/tag/v6.5.3' label: security-advisories@github.com - url: >- https://github.com/tornadoweb/tornado/security/advisories/GHSA-c98p-7wgm-6p64 label: security-advisories@github.com - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67725.json - url: 'https://access.redhat.com/security/cve/CVE-2025-67725' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2421722' - url: 'https://www.cve.org/CVERecord?id=CVE-2025-67725' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-67725' - url: 'https://access.redhat.com/errata/RHSA-2026:0930' - url: 'https://access.redhat.com/errata/RHSA-2026:2462' - url: 'https://access.redhat.com/errata/RHSA-2026:2469' - url: 'https://access.redhat.com/errata/RHSA-2026:2465' - url: 'https://access.redhat.com/errata/RHSA-2026:2484' - url: 'https://access.redhat.com/errata/RHSA-2026:2106' - url: 'https://access.redhat.com/errata/RHSA-2026:3713' tags: - nvd - osv - pip - csaf - vex - red-hat - score-dispute epss: 0.00559 epssPercentile: 0.46366 aliases: - PYSEC-2025-266 - GHSA-c98p-7wgm-6p64 ecosystem: pip ingestedAt: '2026-07-13T18:58:06.924Z' scores: nvd: 7.5 vendor: 5.3 --- ## Overview Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same header name is repeated, causing a Denial of Service (DoS). Due to Python string immutability, each concatenation copies the entire string, resulting in O(n²) time complexity. The severity can vary from high if max_header_size has been increased from its default, to low if it has its default value of 64KB. This issue is fixed in version 6.5.3. ## Affected - `tornado < 6.5.3` ## Remediation Upgrade past the affected range: - `tornado 6.5.3` ## Package advisory (CVE-2025-67725) Affected packages: - `tornado < 6.5.3` Patched in: - `tornado 6.5.3` Source: https://osv.dev/vulnerability/PYSEC-2025-266 ## Vendor advisories - **RHSA-2026:0930** · Red Hat · fixed in: Red Hat Enterprise Linux HighAvailability (v. 8), Red Hat Enterprise Linux ResilientStorage (v. 8) · released 2026-01-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:0930) - **RHSA-2026:2462** · Red Hat · fixed in: Red Hat Enterprise Linux High Availability AUS (v.8.4), Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) · released 2026-02-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:2462) - **RHSA-2026:2469** · Red Hat · fixed in: Red Hat Enterprise Linux High Availability E4S (v.8.6), Red Hat Enterprise Linux High Availability TUS (v.8.6) · released 2026-02-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:2469) - **RHSA-2026:2465** · Red Hat · fixed in: Red Hat Enterprise Linux High Availability E4S (v.8.8), Red Hat Enterprise Linux High Availability TUS (v.8.8) · released 2026-02-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:2465) - **RHSA-2026:2484** · Red Hat · fixed in: Red Hat Enterprise Linux High Availability E4S (v.9.0), Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) · released 2026-02-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:2484) - **RHSA-2026:2106** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-02-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:2106) - **RHSA-2026:3713** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-03-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:3713) - **Red Hat VEX** · Moderate · affected: external secrets operator for Red Hat OpenShift - Tech Preview, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux AI (RHEL AI) 3 · no fix planned: external secrets operator for Red Hat OpenShift - Tech Preview, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67725.json)