Denial of Service Vulnerability in Tornado Python Web Framework

CVE-2025-67726

What is CVE-2025-67726?

Tornado, a popular Python web framework, contains a vulnerability in versions 6.5.2 and earlier that allows remote attackers to exploit inefficient parameter parsing in HTTP header values. Specifically, the issue lies in the _parseparam function in httputil.py, where the method inefficiently handles quotes within parameters using string.count() within a nested loop. An attacker can craft a request containing numerous malicious parameters in the Content-Disposition header, leading to a significant increase in CPU usage due to quadratic time complexity (O(n²)), effectively causing the server to become unresponsive for an extended period due to Tornado's single event loop architecture. This flaw has been resolved in version 6.5.3.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References