PT-2025-50888 · Tornado+4 · Tornado+4
Finder16
·
Published
2025-12-10
·
Updated
2026-04-10
·
CVE-2025-67726
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Tornado versions 6.5.2 and below
Description
Tornado, a Python web framework and asynchronous networking library, is susceptible to a denial-of-service (DoS) condition. The
parseparam function within the httputil.py file utilizes an inefficient algorithm when parsing parameters in HTTP header values, specifically when handling multipart/form-data. Repeated calls to string.count() within a nested loop, while processing quoted semicolons, lead to quadratic time complexity (O(n²)) when parsing maliciously crafted parameters in a Content-Disposition header. This can cause the server to become unresponsive due to Tornado’s single event loop architecture.Recommendations
Update to Tornado version 6.5.3 or later.
Exploit
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Linuxmint
Rocky Linux
Tornado
Ubuntu