Read the docs
TI-2025-41422 Aliases CVE-2025-67726GHSA-jhmp-mqwm-3gq8

Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters

Priority MEDIUM 40CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 12 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00535 45th percentileScored 2026-11-07
Fix Partial tornado (tornadoweb): 6.5.3tornado (PyPI): 6.5.3Red Hat: 7 advisoriesRed Hat: 12 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tornadowebtornadobefore 6.5.36.5.3Patch availableCNA
—tornado (PyPI)before 6.5.36.5.3Patch availableGHSA-jhmp-mqwm-3gq8
  • tornado Vendortornadoweb Affected before 6.5.3 Fixed in 6.5.3 Patch available CNA
  • tornado (PyPI) Vendor— Affected before 6.5.3 Fixed in 6.5.3 Patch available GHSA-jhmp-mqwm-3gq8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:*before 6.5.3Vulnerabletornadoweb
  • cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:* Versions before 6.5.3 Vulnerable ·tornadoweb

Remediation

  • Fix · CNA tornado (tornadoweb) Fixed in 6.5.3
  • Fix · GHSA-jhmp-mqwm-3gq8 tornado (PyPI) Fixed in 6.5.3 Advisory →

Red Hat 7 advisories

  • RHSA-2026:3713 Released 2026-03-04 · Red Hat rating Critical
    RHOAI 3.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:2484 Released 2026-02-10 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.9.0) pcs-0.11.1-10.el9_0.10, pcs-snmp-0.11.1-10.el9_0.10
    • Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) pcs-0.11.1-10.el9_0.10, pcs-snmp-0.11.1-10.el9_0.10
  • RHSA-2026:2469 Released 2026-02-10 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.6) pcs-0.10.12-6.el8_6.12, pcs-snmp-0.10.12-6.el8_6.12
    • Red Hat Enterprise Linux High Availability TUS (v.8.6) pcs-0.10.12-6.el8_6.12, pcs-snmp-0.10.12-6.el8_6.12
Show 4 more Red Hat advisories
  • RHSA-2026:2465 Released 2026-02-10 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.8) pcs-0.10.15-4.el8_8.10, pcs-snmp-0.10.15-4.el8_8.10
    • Red Hat Enterprise Linux High Availability TUS (v.8.8) pcs-0.10.15-4.el8_8.10, pcs-snmp-0.10.15-4.el8_8.10
  • RHSA-2026:2462 Released 2026-02-10 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) pcs-0.10.8-1.el8_4.10, pcs-snmp-0.10.8-1.el8_4.10
    • Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) pcs-0.10.8-1.el8_4.10, pcs-snmp-0.10.8-1.el8_4.10
  • RHSA-2026:2106 Released 2026-02-05 · Red Hat rating Important
    RHOAI 2.25.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:0930 Released 2026-01-21 · Red Hat rating Moderate
    pcs security update
    • Red Hat Enterprise Linux HighAvailability (v. 8) pcs-0.10.18-2.el8_10.8, pcs-snmp-0.10.18-2.el8_10.8
    • Red Hat Enterprise Linux ResilientStorage (v. 8) pcs-0.10.18-2.el8_10.8, pcs-snmp-0.10.18-2.el8_10.8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Security 4AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix planned: Will not fix
external secrets operator for Red Hat OpenShift - Tech PreviewAffectedNo fix planned: Will not fix
Red Hat Enterprise Linux High Availability AUS (v.8.4)Fixed RHSA-2026:2462
Red Hat Enterprise Linux High Availability E4S (v.8.6)Fixed RHSA-2026:2469
Red Hat Enterprise Linux High Availability E4S (v.8.8)Fixed RHSA-2026:2465
Red Hat Enterprise Linux High Availability E4S (v.9.0)Fixed RHSA-2026:2484
Red Hat Enterprise Linux High Availability TUS (v.8.6)Fixed RHSA-2026:2469
Red Hat Enterprise Linux High Availability TUS (v.8.8)Fixed RHSA-2026:2465
Red Hat Enterprise Linux HighAvailability (v. 8)Fixed RHSA-2026:0930
Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4)Fixed RHSA-2026:2462
Red Hat Enterprise Linux ResilientStorage (v. 8)Fixed RHSA-2026:0930
Red Hat Enterprise Linux ResilientStorage E4S (v.9.0)Fixed RHSA-2026:2484
Red Hat OpenShift AI 2.25Fixed RHSA-2026:2106
Red Hat OpenShift AI 3.3Fixed RHSA-2026:3713
Not affected: 9 products
  • External Secrets Operator for Red Hat OpenShift
  • OpenShift Service Mesh 2
  • OpenShift Service Mesh 3
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-67726
  2. 2026-10-03 Alias added: GHSA-jhmp-mqwm-3gq8

References

Patch 1

Advisory 2

Other 3

  • TI-2026-24502 Tornado has a DoS due to too many multipart parts CVSS 4.0HIGH 8.7
  • TI-2024-35317 Tornado has HTTP cookie parsing DoS vulnerability CVSS 3.1HIGH 7.5
  • TI-2025-41421 Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing CVSS 3.1HIGH 7.5
  • TI-2025-29817 Tornado vulnerable to excessive logging caused by malformed multipart form data CVSS 3.1HIGH 7.5
  • TI-2026-27646 In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path… CVSS 3.1HIGH 7.2
  • TI-2014-07904 Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be… CVSS 3.1MEDIUM 6.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences