Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing
Priority MEDIUM 40CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 12 fixed, 4 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same header name is repeated, causing a Denial of Service (DoS). Due to Python string immutability, each concatenation copies the entire string, resulting in O(n²) time complexity. The severity can vary from high if max_header_size has been increased from its default, to low if it has its default value of 64KB. This issue is fixed in version 6.5.3.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00559 46th percentileScored 2026-11-07
Fix Partial tornado (tornadoweb): 6.5.3tornado (PyPI): 6.5.3Red Hat: 7 advisoriesRed Hat: 12 fixed, 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tornadoweb | tornado | before 6.5.3 | 6.5.3 | Patch available | CNA |
| — | tornado (PyPI) | before 6.5.3 | 6.5.3 | Patch available | GHSA-c98p-7wgm-6p64 |
- tornado Vendortornadoweb Affected before 6.5.3 Fixed in 6.5.3 Patch available CNA
- tornado (PyPI) Vendor— Affected before 6.5.3 Fixed in 6.5.3 Patch available GHSA-c98p-7wgm-6p64
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:* | before 6.5.3 | Vulnerable | tornadoweb |
- cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:* Versions before 6.5.3 Vulnerable ·tornadoweb
Remediation
- Fix · CNA tornado (tornadoweb) Fixed in 6.5.3
- Fix · GHSA-c98p-7wgm-6p64 tornado (PyPI) Fixed in 6.5.3 Advisory →
Red Hat 7 advisories
- RHSA-2026:3713 Released 2026-03-04 · Red Hat rating CriticalRHOAI 3.3 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
- RHSA-2026:2484 Released 2026-02-10 · Red Hat rating Importantpcs security update
- Red Hat Enterprise Linux High Availability E4S (v.9.0) pcs-0.11.1-10.el9_0.10, pcs-snmp-0.11.1-10.el9_0.10
- Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) pcs-0.11.1-10.el9_0.10, pcs-snmp-0.11.1-10.el9_0.10
- RHSA-2026:2469 Released 2026-02-10 · Red Hat rating Importantpcs security update
- Red Hat Enterprise Linux High Availability E4S (v.8.6) pcs-0.10.12-6.el8_6.12, pcs-snmp-0.10.12-6.el8_6.12
- Red Hat Enterprise Linux High Availability TUS (v.8.6) pcs-0.10.12-6.el8_6.12, pcs-snmp-0.10.12-6.el8_6.12
Show 4 more Red Hat advisories
- RHSA-2026:2465 Released 2026-02-10 · Red Hat rating Importantpcs security update
- Red Hat Enterprise Linux High Availability E4S (v.8.8) pcs-0.10.15-4.el8_8.10, pcs-snmp-0.10.15-4.el8_8.10
- Red Hat Enterprise Linux High Availability TUS (v.8.8) pcs-0.10.15-4.el8_8.10, pcs-snmp-0.10.15-4.el8_8.10
- RHSA-2026:2462 Released 2026-02-10 · Red Hat rating Importantpcs security update
- Red Hat Enterprise Linux High Availability AUS (v.8.4) pcs-0.10.8-1.el8_4.10, pcs-snmp-0.10.8-1.el8_4.10
- Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) pcs-0.10.8-1.el8_4.10, pcs-snmp-0.10.8-1.el8_4.10
- RHSA-2026:2106 Released 2026-02-05 · Red Hat rating ImportantRHOAI 2.25.2 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:0930 Released 2026-01-21 · Red Hat rating Moderatepcs security update
- Red Hat Enterprise Linux HighAvailability (v. 8) pcs-0.10.18-2.el8_10.8, pcs-snmp-0.10.18-2.el8_10.8
- Red Hat Enterprise Linux ResilientStorage (v. 8) pcs-0.10.18-2.el8_10.8, pcs-snmp-0.10.18-2.el8_10.8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix planned: Will not fix |
| external secrets operator for Red Hat OpenShift - Tech Preview | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux High Availability AUS (v.8.4) | Fixed | RHSA-2026:2462 |
| Red Hat Enterprise Linux High Availability E4S (v.8.6) | Fixed | RHSA-2026:2469 |
| Red Hat Enterprise Linux High Availability E4S (v.8.8) | Fixed | RHSA-2026:2465 |
| Red Hat Enterprise Linux High Availability E4S (v.9.0) | Fixed | RHSA-2026:2484 |
| Red Hat Enterprise Linux High Availability TUS (v.8.6) | Fixed | RHSA-2026:2469 |
| Red Hat Enterprise Linux High Availability TUS (v.8.8) | Fixed | RHSA-2026:2465 |
| Red Hat Enterprise Linux HighAvailability (v. 8) | Fixed | RHSA-2026:0930 |
| Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) | Fixed | RHSA-2026:2462 |
| Red Hat Enterprise Linux ResilientStorage (v. 8) | Fixed | RHSA-2026:0930 |
| Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) | Fixed | RHSA-2026:2484 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:2106 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:3713 |
Not affected: 10 products
- External Secrets Operator for Red Hat OpenShift
- OpenShift Service Mesh 2
- OpenShift Service Mesh 3
- Red Hat Advanced Cluster Security 4
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
- Red Hat OpenShift Container Platform 4
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
Timeline
- 2026-10-02 Threatist record created from CVE-2025-67725
- 2026-10-03 Alias added: GHSA-c98p-7wgm-6p64
References
Advisory 2
More tornadoweb Tornado vulnerabilities
- TI-2026-24502 Tornado has a DoS due to too many multipart parts CVSS 4.0HIGH 8.7
- TI-2024-35317 Tornado has HTTP cookie parsing DoS vulnerability CVSS 3.1HIGH 7.5
- TI-2025-41422 Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters CVSS 3.1HIGH 7.5
- TI-2025-29817 Tornado vulnerable to excessive logging caused by malformed multipart form data CVSS 3.1HIGH 7.5
- TI-2026-27646 In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path… CVSS 3.1HIGH 7.2
- TI-2014-07904 Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be… CVSS 3.1MEDIUM 6.5
Sources
- CVE-2025-67725 · CVE Program
- CVE-2025-67725 · NVD
- FIRST EPSS
- GHSA-c98p-7wgm-6p64 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-67725 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences