CVE-2025-67724

Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom "reason" phrases (the "Not Found" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). This issue is fixed in version 6.5.3.

• CWE-79
• CWE-644

• https://github.com/tornadoweb/tornado/commit/9c163aebeaad9e6e7d28bac1f33580eb00b0e421Patch
• https://github.com/tornadoweb/tornado/releases/tag/v6.5.3Release Notes
• https://github.com/tornadoweb/tornado/security/advisories/GHSA-pr2v-jx2c-wg9fMitigation, Vendor Advisory

Published

Dec 12, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-67719Ibexa is a composable end-to-end DXP (Digital Experience Pla…8.5
• CVE-2025-6772A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2…7.5
• CVE-2025-67720Pyrofork is a modern, asynchronous MTProto API framework. Ve…6.5
• CVE-2025-67721Aircompressor is a library with ports of the Snappy, LZO, LZ…7.5
• CVE-2025-67722FreePBX is an open-source web-based graphical user interface…7.8
• CVE-2025-67723Discourse is an open source discussion platform. Versions pr…5.4
• CVE-2025-67725Tornado is a Python web framework and asynchronous networkin…7.5
• CVE-2025-67726Tornado is a Python web framework and asynchronous networkin…7.5
• CVE-2025-67727Parse Server is an open source backend that can be deployed …9.8
• CVE-2025-67728Fireshare facilitates self-hosted media and link sharing. Ve…9.8
• CVE-2025-67729LMDeploy is a toolkit for compressing, deploying, and servin…8.8
• CVE-2025-6773A vulnerability was found in HKUDS LightRAG up to 1.3.8. It …5.3