Detections
Analytics
Alpine: py3-tornado: security update to 6.5.4-r0
medium Tenable Self-Hosted Container Security Plugin ID 444816
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the
supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or
in HTML in the default error page (where it could be used for XSS) and can be exploited by passing
untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and
tornado.web.HTTPError, the argument is designed to allow applications to pass custom "reason" phrases (the
"Not Found" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes).
This issue is fixed in version 6.5.3. (CVE-2025-67724)
- Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a
single maliciously crafted HTTP request can block the server's event loop for an extended period, caused
by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same
header name is repeated, causing a Denial of Service (DoS). Due to Python string immutability, each
concatenation copies the entire string, resulting in O(n²) time complexity. The severity can vary from
high if max_header_size has been increased from its default, to low if it has its default value of 64KB.
This issue is fixed in version 6.5.3. (CVE-2025-67725)
- Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an
inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The
_parseparam function in httputil.py is used to parse specific HTTP header values, such as those in
multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted
semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a
Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to
Tornado's single event loop architecture, a single malicious request can cause the entire server to become
unresponsive for an extended period. This issue is fixed in version 6.5.3. (CVE-2025-67726)
Solution
Update the py3-tornado library and its related packages to version 6.5.4-r0 or later.See Also
https://security.alpinelinux.org/vuln/CVE-2025-67724
Plugin Details
Severity: Medium
ID: 444816
Version: Revision 1.1
Type: Local
Published: 7/17/2026
Updated: 7/17/2026
Supported Sensors: Agentless Assessment
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.38
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 4.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2025-67724
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 5.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 12/12/2025