HTTP Header Injection and XSS Vulnerability in Tornado Web Framework
CVE-2025-67724

5.4MEDIUM

Key Information:

Vendor: Tornadoweb
Status: Tornado
Vendor: CVE Published:; 12 December 2025

What is CVE-2025-67724?

CVE-2025-67724 is a notable vulnerability in the Tornado web framework, an asynchronous networking library primarily used in Python applications. Tornado serves to enable rapid web applications through non-blocking network connections, making it a common choice for real-time services. This vulnerability arises from how the framework processes HTTP headers, specifically related to the customization of the status messages returned to clients. In versions 6.5.2 and earlier, the framework fails to properly escape the reason phrase provided in HTTP responses, which opens the door for HTTP header injection attacks and cross-site scripting (XSS) vulnerabilities. An attacker could exploit this by injecting malicious data into the reason argument, particularly affecting applications that rely on Tornado for serving custom error messages. The repercussions of this flaw could greatly undermine application integrity, potentially compromising user data and system security.

Potential impact of CVE-2025-67724

HTTP Header Injection: The vulnerability allows attackers to manipulate HTTP headers, which could result in unexpected behavior of the application. This can be leveraged to perform actions such as redirecting users or spoofing responses, endangering the trustworthiness of the application.
Cross-Site Scripting (XSS): By exploiting this vulnerability, attackers can inject malicious scripts into the application's response pages. If executed in a user's browser, this could lead to session hijacking, theft of sensitive information, or spreading of malware.
Reputational Damage: If exploited, organizations may face severe reputational harm due to the exposure of user data or the release of malicious content. The trust in the application's security could be severely damaged, leading to loss of customers and significant financial repercussions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch