Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.

oracle_linux ELSA-2026-0930: ELSA-2026-0930:  pcs security update (MODERATE)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-089:01 advisory.

    * tornado: Tornado Quadratic DoS via Repeated Header Coalescing (CVE-2025-67725)
      * tornado: Tornado Quadratic DoS via Crafted Multipart Parameters (CVE-2025-67726)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:0930 advisory.

    * tornado: Tornado Quadratic DoS via Repeated Header Coalescing (CVE-2025-67725)
      * tornado: Tornado Quadratic DoS via Crafted Multipart Parameters (CVE-2025-67726)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0222-1 advisory.

    - CVE-2025-67725: inefficient algorithm when parsing parameters for HTTP header values (bsc#1254905).
    - CVE-2025-67726: Denial of Service (DoS) via maliciously crafted HTTP request caused by the     HTTPHeaders.add method (bsc#1254904).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:0930 advisory.

    * tornado: Tornado Quadratic DoS via Repeated Header Coalescing (CVE-2025-67725)

    * tornado: Tornado Quadratic DoS via Crafted Multipart Parameters (CVE-2025-67726)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0930 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * tornado: Tornado Quadratic DoS via Repeated Header Coalescing (CVE-2025-67725)

    * tornado: Tornado Quadratic DoS via Crafted Multipart Parameters (CVE-2025-67726)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:20028-1 advisory.

    - CVE-2025-67724: unescaped `reason` argument used in HTTP headers and in HTML default error pages can be     used by       attackers to launch header injection or XSS attacks (bsc#1254903).
    - CVE-2025-67725: quadratic complexity of string concatenation operations used by the `HTTPHeaders.add`     method can lead       o DoS when processing a maliciously crafted HTTP request (bsc#1254905).
    - CVE-2025-67726: quadratic complexity algorithm used in the `_parseparam` function of `httputil.py` can     lead to DoS       when processing maliciously crafted parameters in a `Content-Disposition` header (bsc#1254904).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20015-1 advisory.

    - CVE-2025-67724: unescaped `reason` argument used in HTTP headers and in HTML default error pages can be     used by       attackers to launch header injection or XSS attacks (bsc#1254903).
    - CVE-2025-67725: quadratic complexity of string concatenation operations used by the `HTTPHeaders.add`     method can lead       o DoS when processing a maliciously crafted HTTP request (bsc#1254905).
    - CVE-2025-67726: quadratic complexity algorithm used in the `_parseparam` function of `httputil.py` can     lead to DoS       when processing maliciously crafted parameters in a `Content-Disposition` header (bsc#1254904).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7950-1 advisory.

    It was discovered that Tornado incorrectly handled special characters in HTTP headers. An attacker could     possibly use this issue to execute a cross- site scripting (XSS) attack. This issue only affected Ubuntu     20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-67724)

    It was discovered that Tornado incorrectly handled repeated HTTP headers. An attacker could possibly use     this issue to cause Tornado to use excessive resources, causing a denial of service. (CVE-2025-67725)

    It was discovered that Tornado incorrectly handled parsing of certain HTTP header values. An attacker     could possibly use this issue to cause Tornado to use excessive resources, causing a denial of service.
    (CVE-2025-67726)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1338 advisory.

    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the     supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or     in HTML in the default error page (where it could be used for XSS) and can be exploited by passing     untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and     tornado.web.HTTPError, the argument is designed to allow applications to pass custom reason phrases (the     Not Found in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes).
    This issue is fixed in version 6.5.3. (CVE-2025-67724)

    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a     single maliciously crafted HTTP request can block the server's event loop for an extended period, caused     by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same     header name is repeated, causing a Denial of Service (DoS).  Due to Python string immutability, each     concatenation copies the entire string, resulting in O(n2) time complexity. The severity can vary from     high if max_header_size has been increased from its default, to low if it has its default value of 64KB.
    This issue is fixed in version 6.5.3. (CVE-2025-67725)

    Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an     inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The
    _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in     multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted     semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a     Content-Disposition header, the server's CPU usage increases quadratically (O(n2)) during parsing. Due to     Tornado's single event loop architecture, a single malicious request can cause the entire server to become     unresponsive for an extended period. This issue is fixed in version 6.5.3. (CVE-2025-67726)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0010-1 advisory.

    - CVE-2025-67724: unescaped `reason` argument used in HTTP headers and in HTML default error pages can be     used by       attackers to launch header injection or XSS attacks (bsc#1254903).
    - CVE-2025-67725: quadratic complexity of string concatenation operations used by the `HTTPHeaders.add`     method can lead       to DoS when processing a maliciously crafted HTTP request (bsc#1254905).
    - CVE-2025-67726: quadratic complexity algorithm used in the `_parseparam` function of `httputil.py` can     lead to DoS       when processing maliciously crafted parameters in a `Content-Disposition` header (bsc#1254904).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python3-tornado installed on the remote host is prior to 5.0.2-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3109 advisory.

    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the     supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or     in HTML in the default error page (where it could be used for XSS) and can be exploited by passing     untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and     tornado.web.HTTPError, the argument is designed to allow applications to pass custom reason phrases (the     Not Found in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes).
    This issue is fixed in version 6.5.3. (CVE-2025-67724)

    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a     single maliciously crafted HTTP request can block the server's event loop for an extended period, caused     by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same     header name is repeated, causing a Denial of Service (DoS).  Due to Python string immutability, each     concatenation copies the entire string, resulting in O(n2) time complexity. The severity can vary from     high if max_header_size has been increased from its default, to low if it has its default value of 64KB.
    This issue is fixed in version 6.5.3. (CVE-2025-67725)

    Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an     inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The
    _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in     multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted     semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a     Content-Disposition header, the server's CPU usage increases quadratically (O(n2)) during parsing. Due to     Tornado's single event loop architecture, a single malicious request can cause the entire server to become     unresponsive for an extended period. This issue is fixed in version 6.5.3. (CVE-2025-67726)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python-tornado installed on the remote host is prior to 4.2.1-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3106 advisory.

    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the     supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or     in HTML in the default error page (where it could be used for XSS) and can be exploited by passing     untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and     tornado.web.HTTPError, the argument is designed to allow applications to pass custom reason phrases (the     Not Found in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes).
    This issue is fixed in version 6.5.3. (CVE-2025-67724)

    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a     single maliciously crafted HTTP request can block the server's event loop for an extended period, caused     by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same     header name is repeated, causing a Denial of Service (DoS).  Due to Python string immutability, each     concatenation copies the entire string, resulting in O(n2) time complexity. The severity can vary from     high if max_header_size has been increased from its default, to low if it has its default value of 64KB.
    This issue is fixed in version 6.5.3. (CVE-2025-67725)

    Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an     inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The
    _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in     multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted     semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a     Content-Disposition header, the server's CPU usage increases quadratically (O(n2)) during parsing. Due to     Tornado's single event loop architecture, a single malicious request can cause the entire server to become     unresponsive for an extended period. This issue is fixed in version 6.5.3. (CVE-2025-67726)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0977 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-67726:
    Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an     inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The
    _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in     multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted     semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a     Content-Disposition header, the server's CPU usage increases quadratically (O(n)) during parsing. Due to     Tornado's single event loop architecture, a single malicious request can cause the entire server to become     unresponsive for an extended period. This issue is fixed in version 6.5.3.

    CVE-2025-67725:
    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a     single maliciously crafted HTTP request can block the server's event loop for an extended period, caused     by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same     header name is repeated, causing a Denial of Service (DoS).  Due to Python string immutability, each     concatenation copies the entire string, resulting in O(n) time complexity. The severity can vary from     high if max_header_size has been increased from its default, to low if it has its default value of 64KB.
    This issue is fixed in version 6.5.3.

    CVE-2025-67724:
    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the     supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or     in HTML in the default error page (where it could be used for XSS) and can be exploited by passing     untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and     tornado.web.HTTPError, the argument is designed to allow applications to pass custom reason phrases (the     Not Found in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes).
    This issue is fixed in version 6.5.3.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an     inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The
    _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in     multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted     semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a     Content-Disposition header, the server's CPU usage increases quadratically (O(n)) during parsing. Due to     Tornado's single event loop architecture, a single malicious request can cause the entire server to become     unresponsive for an extended period. This issue is fixed in version 6.5.3. (CVE-2025-67726)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
297003	MiracleLinux 8 : pcs-0.10.18-2.el8_10.8.ML.1 (AXSA:2026-089:01)	Nessus	Miracle Linux Local Security Checks	high
296491	AlmaLinux 8 : pcs (ALSA-2026:0930)	Nessus	Alma Linux Local Security Checks	high
296457	SUSE SLED15 / SLES15 Security Update : python-tornado (SUSE-SU-2026:0222-1)	Nessus	SuSE Local Security Checks	high
296253	RockyLinux 8 : pcs (RLSA-2026:0930)	Nessus	Rocky Linux Local Security Checks	high
295028	RHEL 8 : pcs (RHSA-2026:0930)	Nessus	Red Hat Local Security Checks	high
288030	SUSE SLES16 Security Update : python-tornado6 (SUSE-SU-2026:20028-1)	Nessus	SuSE Local Security Checks	medium
284819	openSUSE 16 Security Update : python-tornado6 (openSUSE-SU-2026:20015-1)	Nessus	SuSE Local Security Checks	medium
282532	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : Tornado vulnerabilities (USN-7950-1)	Nessus	Ubuntu Local Security Checks	medium
282407	Amazon Linux 2023 : python3-tornado (ALAS2023-2025-1338)	Nessus	Amazon Linux Local Security Checks	medium
281851	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-tornado6 (SUSE-SU-2026:0010-1)	Nessus	SuSE Local Security Checks	medium
281825	Amazon Linux 2 : python3-tornado, --advisory ALAS2-2025-3109 (ALAS-2025-3109)	Nessus	Amazon Linux Local Security Checks	medium
281816	Amazon Linux 2 : python-tornado, --advisory ALAS2-2025-3106 (ALAS-2025-3106)	Nessus	Amazon Linux Local Security Checks	medium
281640	TencentOS Server 4: python-tornado (TSSA-2025:0977)	Nessus	Tencent Local Security Checks	medium
278566	Linux Distros Unpatched Vulnerability : CVE-2025-67726	Nessus	Misc.	high

Detections

Analytics

CVE-2025-67726

high

Tenable Plugins

Coming Soon

high

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

high