Threat database

CVE-2025-67725 is a high-severity Denial of Service (DoS) vulnerability in Tornado's HTTPHeaders.add method. The vulnerability arises from repeated header names causing quadratic time complexity due to string concatenation in Python, which can block Tornado's single event loop and disrupt service. The impact is more severe if the max_header_size setting is increased beyond its default 64KB. A patch addressing this issue is available from Red Hat for affected packages.

Tornado versions prior to 6.5.3 have a vulnerability in HTTP status handling where untrusted input passed to the 'reason' argument can lead to HTTP header injection and reflected cross-site scripting (XSS). This affects applications that use RequestHandler.set_status or tornado.web.HTTPError with unsanitized 'reason' input. The vulnerability is fixed in Tornado 6.5.3 and later. Ubuntu has released security updates for affected Tornado packages in various LTS and interim releases. Exploitation requires control over the 'reason' argument, potentially allowing arbitrary JavaScript execution in users' browsers.

### Summary When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. ### Affected versions All versions of Tornado prior to 6.5 are affected. The vulnerable parser is enabled by default. ### Solution Upgrade to Tornado version 6.5. In the meantime, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.

CVE-2024-52804 is a denial-of-service vulnerability in the Tornado Python web framework affecting versions prior to 6.4.2. The flaw is due to the HTTP cookie parsing algorithm exhibiting quadratic complexity when processing certain malicious cookie headers, leading to excessive CPU usage and blocking the event loop thread. This results in a denial of service. A patch is available to address this issue.