CVE-2025-67724: fallo de gravedad media en tornadoweb tornado
Tornado vulnerable to Header Injection and XSS via reason argument
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.4epss 0.2%
Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom "reason" phrases (the "Not Found" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). This issue is fixed in version 6.5.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Productos afectados
tornadoweb · tornadoCVEs relacionadas — tornadoweb tornado
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-52804HIGHTornado has HTTP cookie parsing DoS vulnerabilityEPSS 1.0%CVE-2025-47287HIGHTornado vulnerable to excessive logging caused by malformed multipart form dataEPSS 0.7%CVE-2026-103262HIGHTornado before 6.5.9 Denial of Service via CurlAsyncHTTPClientEPSS 0.6%CVE-2026-49855HIGHtornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)EPSS 0.6%CVE-2025-67725HIGHTornado is Vulnerable to Quadratic DoS via Repeated Header CoalescingEPSS 0.6%CVE-2025-67726HIGHTornado is Vulnerable to Quadratic DoS via Crafted Multipart ParametersEPSS 0.5%