Skip to content
OpenAdvisories
High DLA-4461-1 3 CVEs

python-tornado - security update

Published Feb 1, 2026 · Updated Feb 1, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 python-tornado 6.1.0-1+deb11u3

Vulnerabilities 3

  • High 7.5
    CVE-2025-67725

    Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing

    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumula…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Azure Linux Alpine PyPI
  • High 7.5
    CVE-2025-67726

    Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters

    Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse sp…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Alpine PyPI
  • Medium 5.4
    CVE-2025-67724

    Tornado vulnerable to Header Injection and XSS via reason argument

    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Azure Linux Alpine PyPI