PT-2025-50884 · Tornado+4 · Tornado+4
Finder16
·
Published
2025-12-12
·
Updated
2026-04-10
·
CVE-2025-67725
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Tornado versions 6.5.2 and below
Description
Tornado, a Python web framework and asynchronous networking library, is susceptible to a Denial of Service (DoS) condition. A single, specially crafted HTTP request can halt the server’s event loop for a prolonged duration. This occurs because the
HTTPHeaders.add function repeatedly concatenates strings when the same header name appears multiple times. Python’s string immutability causes each concatenation to copy the entire string, leading to O(n²) time complexity. The impact ranges from high to low, depending on the max header size configuration; a larger value increases the severity. The issue stems from the way headers are processed, specifically within the add function.Recommendations
Versions prior to 6.5.3 should be updated to version 6.5.3 or later.
Exploit
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Rocky Linux
Tornado
Ubuntu