CVE-2025-67726 Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2025-67726?
CVE-2025-67726 is a high-severity vulnerability in tornadoweb tornado, published on 12 Dec 2025.
Official description
Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.
Which versions are affected by CVE-2025-67726?
3 open source packages ship an affected version, including tornado. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tornado PyPI | All versions | 6.5.3 |
tornado PyPI | All versions | 6.5.3 |
tornado PyPI | All versions | 6.5.3 |
Products include Tornadoweb Tornado.
How do I fix CVE-2025-67726?
Upgrade tornado to 6.5.3 or later.
Is CVE-2025-67726 being exploited?
There is no known exploitation of CVE-2025-67726 in the wild and no public exploit code.
Other vulnerabilities in tornadoweb tornado
- CVE-2026-31958 Tornado has a DoS due to too many multipart parts
- CVE-2025-67725 Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing
- CVE-2024-52804 Tornado has HTTP cookie parsing DoS vulnerability
- CVE-2026-35536 Tornado has incomplete validation of cookie attributes
- CVE-2014-9720 Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)
Sources
Also known as BELL-CVE-2025-67726, DEBIAN-CVE-2025-67726, ECHO-43db-f673-83aa, GHSA-jhmp-mqwm-3gq8, MINI-f2p2-gf63-phgv, MINI-vrpm-vq8p-c7rh and 4 more.