CVE-2025-67724: Tornado vulnerable to Header Injection and XSS via reason argument

Vulnerability summary

CVE-2025-67724 is a medium (CVSS 6.1) vulnerability in tornadoweb tornado. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 15.1% of scored vulnerabilities.

Timeline

1. 12-12-2025
   PublishedVulnerability first disclosed.
2. 18-12-2025
   Last modifiedVulnerability information updated.

Description

Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom "reason" phrases (the "Not Found" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). This issue is fixed in version 6.5.3.

• CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
• CWE-644Improper Neutralization of HTTP Headers for Scripting SyntaxThe product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.