CVE-2025-67726

Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.

• CWE-400
• CWE-834

• https://github.com/tornadoweb/tornado/commit/771472cfdaeebc0d89a9cc46e249f8891a6b29cdPatch
• https://github.com/tornadoweb/tornado/releases/tag/v6.5.3Release Notes
• https://github.com/tornadoweb/tornado/security/advisories/GHSA-jhmp-mqwm-3gq8Vendor Advisory

Published

Dec 12, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-67720Pyrofork is a modern, asynchronous MTProto API framework. Ve…6.5
• CVE-2025-67721Aircompressor is a library with ports of the Snappy, LZO, LZ…7.5
• CVE-2025-67722FreePBX is an open-source web-based graphical user interface…7.8
• CVE-2025-67723Discourse is an open source discussion platform. Versions pr…5.4
• CVE-2025-67724Tornado is a Python web framework and asynchronous networkin…6.1
• CVE-2025-67725Tornado is a Python web framework and asynchronous networkin…7.5
• CVE-2025-67727Parse Server is an open source backend that can be deployed …9.8
• CVE-2025-67728Fireshare facilitates self-hosted media and link sharing. Ve…9.8
• CVE-2025-67729LMDeploy is a toolkit for compressing, deploying, and servin…8.8
• CVE-2025-6773A vulnerability was found in HKUDS LightRAG up to 1.3.8. It …5.3
• CVE-2025-67730Frappe Learning Management System (LMS) is a learning system…5.4
• CVE-2025-67731Servify Express is a Node.js package to start an Express ser…7.5