Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom "reason" phrases (the "Not Found" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). This issue is fixed in version 6.5.3.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4461 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4461-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     February 01, 2026                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-tornado     Version        : 6.1.0-1+deb11u3     CVE ID         : CVE-2025-67724 CVE-2025-67725 CVE-2025-67726     Debian Bug     : 1122660 1122661 1122663

    Tornado is a scalable, non-blocking Python web framework and     asynchronous networking library.

    CVE-2025-67724

       Custom reason phrases can cause multiple vulnerabilities (like XSS,        header injection, ...) due to being used unescaped in HTTP headers.

    CVE-2025-67725

       A single maliciously crafted HTTP request can cause a possible DoS        due to quadratic performance of repeated header lines.

    CVE-2025-67726

       An inefficient algorithm when parsing parameters for HTTP header        values can potentially cause a DoS.

    For Debian 11 bullseye, these problems have been fixed in version     6.1.0-1+deb11u3.

    We recommend that you upgrade your python-tornado packages.

    For the detailed security status of python-tornado please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-tornado

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:20028-1 advisory.

    - CVE-2025-67724: unescaped `reason` argument used in HTTP headers and in HTML default error pages can be     used by       attackers to launch header injection or XSS attacks (bsc#1254903).
    - CVE-2025-67725: quadratic complexity of string concatenation operations used by the `HTTPHeaders.add`     method can lead       o DoS when processing a maliciously crafted HTTP request (bsc#1254905).
    - CVE-2025-67726: quadratic complexity algorithm used in the `_parseparam` function of `httputil.py` can     lead to DoS       when processing maliciously crafted parameters in a `Content-Disposition` header (bsc#1254904).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20015-1 advisory.

    - CVE-2025-67724: unescaped `reason` argument used in HTTP headers and in HTML default error pages can be     used by       attackers to launch header injection or XSS attacks (bsc#1254903).
    - CVE-2025-67725: quadratic complexity of string concatenation operations used by the `HTTPHeaders.add`     method can lead       o DoS when processing a maliciously crafted HTTP request (bsc#1254905).
    - CVE-2025-67726: quadratic complexity algorithm used in the `_parseparam` function of `httputil.py` can     lead to DoS       when processing maliciously crafted parameters in a `Content-Disposition` header (bsc#1254904).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7950-1 advisory.

    It was discovered that Tornado incorrectly handled special characters in HTTP headers. An attacker could     possibly use this issue to execute a cross- site scripting (XSS) attack. This issue only affected Ubuntu     20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-67724)

    It was discovered that Tornado incorrectly handled repeated HTTP headers. An attacker could possibly use     this issue to cause Tornado to use excessive resources, causing a denial of service. (CVE-2025-67725)

    It was discovered that Tornado incorrectly handled parsing of certain HTTP header values. An attacker     could possibly use this issue to cause Tornado to use excessive resources, causing a denial of service.
    (CVE-2025-67726)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1338 advisory.

    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the     supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or     in HTML in the default error page (where it could be used for XSS) and can be exploited by passing     untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and     tornado.web.HTTPError, the argument is designed to allow applications to pass custom reason phrases (the     Not Found in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes).
    This issue is fixed in version 6.5.3. (CVE-2025-67724)

    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a     single maliciously crafted HTTP request can block the server's event loop for an extended period, caused     by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same     header name is repeated, causing a Denial of Service (DoS).  Due to Python string immutability, each     concatenation copies the entire string, resulting in O(n2) time complexity. The severity can vary from     high if max_header_size has been increased from its default, to low if it has its default value of 64KB.
    This issue is fixed in version 6.5.3. (CVE-2025-67725)

    Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an     inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The
    _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in     multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted     semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a     Content-Disposition header, the server's CPU usage increases quadratically (O(n2)) during parsing. Due to     Tornado's single event loop architecture, a single malicious request can cause the entire server to become     unresponsive for an extended period. This issue is fixed in version 6.5.3. (CVE-2025-67726)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0010-1 advisory.

    - CVE-2025-67724: unescaped `reason` argument used in HTTP headers and in HTML default error pages can be     used by       attackers to launch header injection or XSS attacks (bsc#1254903).
    - CVE-2025-67725: quadratic complexity of string concatenation operations used by the `HTTPHeaders.add`     method can lead       to DoS when processing a maliciously crafted HTTP request (bsc#1254905).
    - CVE-2025-67726: quadratic complexity algorithm used in the `_parseparam` function of `httputil.py` can     lead to DoS       when processing maliciously crafted parameters in a `Content-Disposition` header (bsc#1254904).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python3-tornado installed on the remote host is prior to 5.0.2-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3109 advisory.

    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the     supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or     in HTML in the default error page (where it could be used for XSS) and can be exploited by passing     untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and     tornado.web.HTTPError, the argument is designed to allow applications to pass custom reason phrases (the     Not Found in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes).
    This issue is fixed in version 6.5.3. (CVE-2025-67724)

    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a     single maliciously crafted HTTP request can block the server's event loop for an extended period, caused     by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same     header name is repeated, causing a Denial of Service (DoS).  Due to Python string immutability, each     concatenation copies the entire string, resulting in O(n2) time complexity. The severity can vary from     high if max_header_size has been increased from its default, to low if it has its default value of 64KB.
    This issue is fixed in version 6.5.3. (CVE-2025-67725)

    Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an     inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The
    _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in     multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted     semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a     Content-Disposition header, the server's CPU usage increases quadratically (O(n2)) during parsing. Due to     Tornado's single event loop architecture, a single malicious request can cause the entire server to become     unresponsive for an extended period. This issue is fixed in version 6.5.3. (CVE-2025-67726)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python-tornado installed on the remote host is prior to 4.2.1-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3106 advisory.

    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the     supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or     in HTML in the default error page (where it could be used for XSS) and can be exploited by passing     untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and     tornado.web.HTTPError, the argument is designed to allow applications to pass custom reason phrases (the     Not Found in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes).
    This issue is fixed in version 6.5.3. (CVE-2025-67724)

    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a     single maliciously crafted HTTP request can block the server's event loop for an extended period, caused     by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same     header name is repeated, causing a Denial of Service (DoS).  Due to Python string immutability, each     concatenation copies the entire string, resulting in O(n2) time complexity. The severity can vary from     high if max_header_size has been increased from its default, to low if it has its default value of 64KB.
    This issue is fixed in version 6.5.3. (CVE-2025-67725)

    Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an     inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The
    _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in     multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted     semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a     Content-Disposition header, the server's CPU usage increases quadratically (O(n2)) during parsing. Due to     Tornado's single event loop architecture, a single malicious request can cause the entire server to become     unresponsive for an extended period. This issue is fixed in version 6.5.3. (CVE-2025-67726)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0977 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-67726:
    Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an     inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The
    _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in     multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted     semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a     Content-Disposition header, the server's CPU usage increases quadratically (O(n)) during parsing. Due to     Tornado's single event loop architecture, a single malicious request can cause the entire server to become     unresponsive for an extended period. This issue is fixed in version 6.5.3.

    CVE-2025-67725:
    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a     single maliciously crafted HTTP request can block the server's event loop for an extended period, caused     by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same     header name is repeated, causing a Denial of Service (DoS).  Due to Python string immutability, each     concatenation copies the entire string, resulting in O(n) time complexity. The severity can vary from     high if max_header_size has been increased from its default, to low if it has its default value of 64KB.
    This issue is fixed in version 6.5.3.

    CVE-2025-67724:
    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the     supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or     in HTML in the default error page (where it could be used for XSS) and can be exploited by passing     untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and     tornado.web.HTTPError, the argument is designed to allow applications to pass custom reason phrases (the     Not Found in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes).
    This issue is fixed in version 6.5.3.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the     supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or     in HTML in the default error page (where it could be used for XSS) and can be exploited by passing     untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and     tornado.web.HTTPError, the argument is designed to allow applications to pass custom reason phrases (the     Not Found in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes).
    This issue is fixed in version 6.5.3. (CVE-2025-67724)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
297501	Debian dla-4461 : python-tornado-doc - security update	Nessus	Debian Local Security Checks	medium
288030	SUSE SLES16 Security Update : python-tornado6 (SUSE-SU-2026:20028-1)	Nessus	SuSE Local Security Checks	medium
284819	openSUSE 16 Security Update : python-tornado6 (openSUSE-SU-2026:20015-1)	Nessus	SuSE Local Security Checks	medium
282532	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : Tornado vulnerabilities (USN-7950-1)	Nessus	Ubuntu Local Security Checks	medium
282407	Amazon Linux 2023 : python3-tornado (ALAS2023-2025-1338)	Nessus	Amazon Linux Local Security Checks	medium
281851	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-tornado6 (SUSE-SU-2026:0010-1)	Nessus	SuSE Local Security Checks	medium
281825	Amazon Linux 2 : python3-tornado, --advisory ALAS2-2025-3109 (ALAS-2025-3109)	Nessus	Amazon Linux Local Security Checks	medium
281816	Amazon Linux 2 : python-tornado, --advisory ALAS2-2025-3106 (ALAS-2025-3106)	Nessus	Amazon Linux Local Security Checks	medium
281640	TencentOS Server 4: python-tornado (TSSA-2025:0977)	Nessus	Tencent Local Security Checks	medium
278567	Linux Distros Unpatched Vulnerability : CVE-2025-67724	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-67724

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium