CVE-2025-67725 Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing
Attackers can cause denial of service in Tornado web framework by sending crafted HTTP requests that trigger quadratic time complexity in header processing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-67725?
CVE-2025-67725 is a high-severity denial of service vulnerability in tornadoweb tornado, published on 12 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same header name is repeated, causing a Denial of Service (DoS). Due to Python string immutability, each concatenation copies the entire string, resulting in O(n²) time complexity. The severity can vary from high if max_header_size has been increased from its default, to low if it has its default value of 64KB. This issue is fixed in version 6.5.3.
Weakness: CWE-400
Which versions are affected by CVE-2025-67725?
3 open source packages ship an affected version, including tornado. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tornado PyPI | All versions | 6.5.3 |
tornado PyPI | All versions | 6.5.3 |
tornado PyPI | All versions | 6.5.3 |
Products include Tornadoweb Tornado.
How do I fix CVE-2025-67725?
Upgrade tornado to 6.5.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-67725 being exploited?
There is no known exploitation of CVE-2025-67725 in the wild and no public exploit code.
Other vulnerabilities in tornadoweb tornado
- CVE-2026-31958 Tornado has a DoS due to too many multipart parts
- CVE-2025-67726 Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters
- CVE-2024-52804 Tornado has HTTP cookie parsing DoS vulnerability
- CVE-2026-35536 Tornado has incomplete validation of cookie attributes
- CVE-2014-9720 Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)
Sources
Also known as AZL-72368, AZL-72374, BELL-CVE-2025-67725, DEBIAN-CVE-2025-67725, ECHO-55f5-3cd1-92e2, GHSA-c98p-7wgm-6p64 and 5 more.