CVE-2025-67725: Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing

Analyzed

AliasesGHSA-c98p-7wgm-6p64PYSEC-2025-266UBUNTU-CVE-2025-67725+2 more

Published 12-12-2025Last modified 18-12-2025

Vulnerability summary

CVE-2025-67725 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in tornadoweb tornado. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 46.5% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.56%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

12-12-2025
PublishedVulnerability first disclosed.
18-12-2025
Last modifiedVulnerability information updated.

Description

Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same header name is repeated, causing a Denial of Service (DoS). Due to Python string immutability, each concatenation copies the entire string, resulting in O(n²) time complexity. The severity can vary from high if max_header_size has been increased from its default, to low if it has its default value of 64KB. This issue is fixed in version 6.5.3.

CVSS metrics

6 scores · 6 sources · 1 version

v3.17.5

EPSS trend

Probability

0.56%

Chance of exploitation in the next 30 days

Percentile

47%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.56% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Alpine1 product

py3-tornado< 6.5.4-r0

Debian1 product

python-tornado< 6.2.0-3+deb12u4 | < 6.4.2-3+deb13u2 | < 6.5.4-0.1

PyPI1 product

tornado< 6.5.3

Tornadoweb1 product

tornado< 6.5.3

Ubuntu1 product

python-tornado< 4.2.1-1ubuntu3.1+esm2 | < 4.5.3-1ubuntu0.2+esm2 | < 6.0.3+really5.1.1-3ubuntu0.1~esm3 | < 6.1.0-3ubuntu0.1~esm4 | < 6.4.0-1ubuntu0.4 | < 6.4.2-3ubuntu0.2

5 vendors · 5 products