CVE-2025-67724 Tornado vulnerable to Header Injection and XSS via reason argument
Attackers can inject malicious scripts or headers via the reason argument in Tornado, leading to XSS or header injection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-67724?
CVE-2025-67724 is a medium-severity cross-site scripting vulnerability in tornadoweb tornado, published on 12 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom "reason" phrases (the "Not Found" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). This issue is fixed in version 6.5.3.
Which versions are affected by CVE-2025-67724?
3 open source packages ship an affected version, including tornado. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tornado PyPI | All versions | 6.5.3 |
tornado PyPI | All versions | 6.5.3 |
tornado PyPI | All versions | 6.5.3 |
Linux distribution packages (5)
python-tornado SUSE:Linux Enterprise Micro 5.2 | All versions | 4.5.3-150000.3.16.1 |
python-tornado SUSE:Linux Enterprise Micro 5.3 | All versions | 4.5.3-150000.3.16.1 |
python-tornado SUSE:Linux Enterprise Micro 5.4 | All versions | 4.5.3-150000.3.16.1 |
python-tornado SUSE:Linux Enterprise Micro 5.5 | All versions | 4.5.3-150000.3.16.1 |
python-tornado SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 4.5.3-150000.3.16.1 |
Products include Tornadoweb Tornado.
How do I fix CVE-2025-67724?
Upgrade tornado to 6.5.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-67724 being exploited?
There is no known exploitation of CVE-2025-67724 in the wild and no public exploit code.
Other vulnerabilities in tornadoweb tornado
- CVE-2026-31958 Tornado has a DoS due to too many multipart parts
- CVE-2025-67725 Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing
- CVE-2025-67726 Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters
- CVE-2024-52804 Tornado has HTTP cookie parsing DoS vulnerability
- CVE-2026-35536 Tornado has incomplete validation of cookie attributes
Sources
Also known as AZL-72371, AZL-72377, BELL-CVE-2025-67724, DEBIAN-CVE-2025-67724, ECHO-1f27-0b91-adc0, GHSA-pr2v-jx2c-wg9f and 5 more.