What’s Vulnerable › Vulnerabilities

CVE-2025-67726: Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-12 · updated 2026-10-07
• Weakness: CWE-400

Description

Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.

Affected products

• tornadoweb tornado: before 6.5.3 — fixed in 6.5.3
• Pypi Tornado: before 6.5.3; 0.2, 1.0, 1.1, 1.1.1, 1.2, 1.2.1 (+72) — fixed in 6.5.3

How to fix

Upgrade to a fixed version: tornadoweb tornado 6.5.3; Pypi Tornado 6.5.3. Check the vendor advisory for mitigations.

References

• https://github.com/tornadoweb/tornado/commit/771472cfdaeebc0d89a9cc46e249f8891a6b29cd
• https://github.com/tornadoweb/tornado/releases/tag/v6.5.3
• https://github.com/tornadoweb/tornado/security/advisories/GHSA-jhmp-mqwm-3gq8

Get alerted when CVE-2025-67726 or the next vulnerability affects your stack