tornadoweb tornado up to 6.5.2 Parameters httputil.py string.count iteration

Summaryinfo

A vulnerability classified as problematic has been found in tornadoweb tornado up to 6.5.2. The affected element is the function string.count of the file httputil.py of the component Parameters Handler. Performing a manipulation results in iteration. This vulnerability is identified as CVE-2025-67726. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in tornadoweb tornado up to 6.5.2. It has been classified as problematic. This affects the function string.count of the file httputil.py of the component Parameters Handler. The manipulation with an unknown input leads to a iteration vulnerability. CWE is classifying the issue as CWE-834. The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed. This is going to have an impact on availability. The summary by CVE is:

Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-67726 since 12/10/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 278566 (Linux Distros Unpatched Vulnerability : CVE-2025-67726), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.5.3 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (278566) and CERT Bund (WID-SEC-2026-0195). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• SUSE Linux
• Oracle Linux
• RESF Rocky Linux
• Red Hat Enterprise Linux

Productinfo

Vendor

• tornadoweb

Name

• tornado

Version

• 6.5.0
• 6.5.1
• 6.5.2

Website

• Product: https://github.com/tornadoweb/tornado/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion