← Vulnerability feed

Vulnerability record · CVE-2025-67726 · published 12 December 2025

CVE-2025-67726: Tornadoweb tornado uncontrolled resource consumption vulnerability

Tornadoweb · Tornado

Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.

7.5 CVSS 3.1 High EPSS 0.53% · top 57.1% CWE-400 · Uncontrolled resource consumptionCWE-834 · CWE-834
7.5CVSS 3.1 base score
0.53%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/tornadoweb/tornado/commit/771472cfdaeebc0d89a9cc46e249f8891a6b29cd Patch
https://github.com/tornadoweb/tornado/releases/tag/v6.5.3 Release Notes
https://github.com/tornadoweb/tornado/security/advisories/GHSA-jhmp-mqwm-3gq8 Vendor Advisory

Track CVE-2025-67726 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-31958Tornadoweb tornado uncontrolled resource consumption vulnerabilityTornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts i…EPSS 0.49%7.5CVE-2025-67725Tornadoweb tornado uncontrolled resource consumption vulnerabilityTornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can blo…EPSS 0.56%7.5CVE-2025-47287Tornadoweb tornado allocation without limits vulnerabilityTornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it lo…EPSS 0.74%7.5CVE-2024-52804Tornadoweb tornado uncontrolled resource consumption vulnerabilityTornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2…EPSS 1.0%6.5CVE-2014-9720Tornadoweb tornado observable discrepancy vulnerabilityTornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remot…EPSS 2.5%6.1CVE-2025-67724Tornadoweb tornado cross-site scripting vulnerabilityTornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in H…EPSS 0.24%6.1CVE-2023-28370Tornadoweb tornado open redirect vulnerabilityOpen redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web sit…EPSS 1.1%5.3CVE-2026-35536Tornadoweb tornado vulnerabilityIn Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were n…EPSS 0.29%

Source: NIST National Vulnerability Database (record CVE-2025-67726), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.