PYSEC-2025-267

🗓️ 12 Dec 2025 07:15:44Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 22 Views

Tornado 6.5.2 and earlier have a DoS from quadratic HTTP header parameter parsing; fixed in 6.5.3.

Reporter	Title	Published	Views	Family All 225
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses tornado-6.5-cp39-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl which is vulnerable to CVE-2025-67724, CVE-2025-67725, CVE-2025-67726.	27 Feb 202611:35	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities exists in IBM Netezza Software	19 Jun 202617:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (April 2026 - Part 1 of 2)	1 May 202605:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Verify Identity Protection Self-Hosted is affected by multiple vulnerabilities	19 Jun 202606:21	–	ibm
Tenable Nessus	Amazon Linux 2023 : python3-tornado (ALAS2023-2025-1338)	8 Jan 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : python3.13-tornado (ALAS2023-2026-1528)	1 Apr 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : python-tornado, --advisory ALAS2-2025-3106 (ALAS-2025-3106)	5 Jan 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : python3-tornado, --advisory ALAS2-2025-3109 (ALAS-2025-3109)	5 Jan 202600:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0020: pcs (ALINUX3-SA-2026:0020)	2 Feb 202600:00	–	nessus
Tenable Nessus	AlmaLinux 8 : pcs (ALSA-2026:0930)	24 Jan 202600:00	–	nessus

Vulners

Node

pypi tornadoRange0–6.5.3

Source	Link
github	www.github.com/tornadoweb/tornado/releases/tag/v6.5.3
github	www.github.com/tornadoweb/tornado/security/advisories/GHSA-jhmp-mqwm-3gq8
github	www.github.com/tornadoweb/tornado/commit/771472cfdaeebc0d89a9cc46e249f8891a6b29cd

13 Jul 2026 05:52Current

7.3High risk

Vulners AI Score7.3

CVSS 3.17.5

EPSS0.00535

SSVC