CVE-2025-67725

🗓️ 12 Dec 2025 06:15:41Reported by [email protected]Type

nvd🔗 web.nvd.nist.gov👁 25 Views

CVE-2025-67725: Tornado before 6.5.3 DoS via crafted HTTP header repeats from string concatenation.

Reporter	Title	Published	Views	Family All 229
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses tornado-6.5-cp39-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl which is vulnerable to CVE-2025-67724, CVE-2025-67725, CVE-2025-67726.	27 Feb 202611:35	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities exists in IBM Netezza Software	19 Jun 202617:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (April 2026 - Part 1 of 2)	1 May 202605:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Verify Identity Protection Self-Hosted is affected by multiple vulnerabilities	19 Jun 202606:21	–	ibm
Tenable Nessus	Amazon Linux 2023 : python3-tornado (ALAS2023-2025-1338)	8 Jan 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : python3.13-tornado (ALAS2023-2026-1528)	1 Apr 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : python-tornado, --advisory ALAS2-2025-3106 (ALAS-2025-3106)	5 Jan 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : python3-tornado, --advisory ALAS2-2025-3109 (ALAS-2025-3109)	5 Jan 202600:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0020: pcs (ALINUX3-SA-2026:0020)	2 Feb 202600:00	–	nessus
Tenable Nessus	AlmaLinux 8 : pcs (ALSA-2026:0930)	24 Jan 202600:00	–	nessus

NVD

Node

tornadoweb tornadoRange<6.5.3

Source	Link
github	www.github.com/tornadoweb/tornado/releases/tag/v6.5.3
github	www.github.com/tornadoweb/tornado/commit/771472cfdaeebc0d89a9cc46e249f8891a6b29cd
github	www.github.com/tornadoweb/tornado/security/advisories/GHSA-c98p-7wgm-6p64

07 Oct 2026 20:10Current

CVSS 3.17.5

EPSS0.00559

SSVC

tornado framework http header repeats string concatenation denial of service version 6.5.3