p PatchFirst

CVE-2025-67725

CVE-2025-67725 · Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same header name is repeated, causing a Denial of Service (DoS). Due to Python string immutability, each concatenation copies the entire string, resulting in O(n²) time complexity. The severity can vary from high if max_header_size has been increased from its default, to low if it has its default value of 64KB. This issue is fixed in version 6.5.3.

CVSS 7.5 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • tornado

    Versions
    • < 6.5.3: Affected

    No fix published

  • python-tornado Debian:12

    Versions
    • 6.2.0-3
    • 6.2.0-3+deb12u1
    • 6.2.0-3+deb12u2
    • 6.2.0-3+deb12u3
    Affected ranges
    • ECOSYSTEM: < 6.2.0-3+deb12u4

    Update to 6.2.0-3+deb12u4

  • python-tornado Debian:13

    Versions
    • 6.4.2-3
    • 6.4.2-3+deb13u1
    Affected ranges
    • ECOSYSTEM: < 6.4.2-3+deb13u2

    Update to 6.4.2-3+deb13u2

  • python-tornado Debian:14

    Versions
    • 6.4.2-3
    • 6.5.2-1
    • 6.5.2-2
    • 6.5.2-3
    Affected ranges
    • ECOSYSTEM: < 6.5.4-0.1

    Update to 6.5.4-0.1

  • tornado PyPI

    Versions
    • 0.2
    • 1.0
    • 1.1
    • 1.1.1
    • 1.2
    • 1.2.1
    • 2.0
    • 2.1
    • 2.1.1
    • 2.2
    • 2.2.1
    • 2.3
    • 2.4
    • 2.4.1
    • 3.0
    • 3.0.1
    • 3.0.2
    • 3.1
    • 3.1.1
    • 3.2
    • 3.2.1
    • 3.2.2
    • 4.0
    • 4.0.1
    • 4.0.2
    • 4.1
    • 4.1b2
    • 4.2
    • 4.2.1
    • 4.2b1
    • 4.3
    • 4.3b1
    • 4.3b2
    • 4.4
    • 4.4.1
    • 4.4.2
    • 4.4.3
    • 4.4b1
    • 4.5
    • 4.5.1
    • 4.5.2
    • 4.5.3
    • 4.5b1
    • 4.5b2
    • 5.0
    • 5.0.1
    • 5.0.2
    • 5.0a1
    • 5.0b1
    • 5.1
    • 5.1.1
    • 5.1b1
    • 6.0
    • 6.0.1
    • 6.0.2
    • 6.0.3
    • 6.0.4
    • 6.0a1
    • 6.0b1
    • 6.1
    • 6.1b1
    • 6.1b2
    • 6.2
    • 6.2b1
    • 6.2b2
    • 6.3
    • 6.3.1
    • 6.3.2
    • 6.3.3
    • 6.3b1
    • 6.4
    • 6.4.1
    • 6.4.2
    • 6.4b1
    • 6.5
    • 6.5.1
    • 6.5.2
    • 6.5b1
    Affected ranges
    • ECOSYSTEM: < 6.5.3

    Update to 6.5.3

  • python-tornado Ubuntu:Pro:16.04:LTS

    Versions
    • 4.2.1-1ubuntu2
    • 4.2.1-1ubuntu3
    • 4.2.1-1ubuntu3.1
    • 4.2.1-1ubuntu3.1+esm1
    Affected ranges
    • ECOSYSTEM: < 4.2.1-1ubuntu3.1+esm2

    Update to 4.2.1-1ubuntu3.1+esm2

  • python-tornado Ubuntu:Pro:18.04:LTS

    Versions
    • 4.5.1-2.1~build2
    • 4.5.2-1
    • 4.5.3-1
    • 4.5.3-1ubuntu0.1
    • 4.5.3-1ubuntu0.2
    • 4.5.3-1ubuntu0.2+esm1
    Affected ranges
    • ECOSYSTEM: < 4.5.3-1ubuntu0.2+esm2

    Update to 4.5.3-1ubuntu0.2+esm2

  • python-tornado Ubuntu:Pro:20.04:LTS

    Versions
    • 5.1.1-4ubuntu1
    • 5.1.1-4ubuntu5
    • 6.0.3+really5.1.1-2
    • 6.0.3+really5.1.1-2build1
    • 6.0.3+really5.1.1-2build2
    • 6.0.3+really5.1.1-3
    • 6.0.3+really5.1.1-3ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 6.0.3+really5.1.1-3ubuntu0.1~esm3

    Update to 6.0.3+really5.1.1-3ubuntu0.1~esm3

  • python-tornado Ubuntu:Pro:22.04:LTS

    Versions
    • 6.1.0-1build1
    • 6.1.0-2
    • 6.1.0-3
    • 6.1.0-3build1
    • 6.1.0-3ubuntu0.1~esm1
    • 6.1.0-3ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: < 6.1.0-3ubuntu0.1~esm4

    Update to 6.1.0-3ubuntu0.1~esm4

  • python-tornado Ubuntu:24.04:LTS

    Versions
    • 6.3.2-1
    • 6.4.0-0ubuntu1
    • 6.4.0-1
    • 6.4.0-1build1
    • 6.4.0-1ubuntu0.1
    • 6.4.0-1ubuntu0.2
    Affected ranges
    • ECOSYSTEM: < 6.4.0-1ubuntu0.4

    Update to 6.4.0-1ubuntu0.4

  • python-tornado Ubuntu:25.10

    Versions
    • 6.4.2-1
    • 6.4.2-2
    • 6.4.2-2ubuntu1
    • 6.4.2-3
    Affected ranges
    • ECOSYSTEM: < 6.4.2-3ubuntu0.2

    Update to 6.4.2-3ubuntu0.2

Original sources

Check your server →