DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2025-67726: CVE-2025-67726: Denial of Service via Quadratic Parameter Parsing in Tornado httputil

#security #cve #cybersecurity

CVE-2025-67726: Denial of Service via Quadratic Parameter Parsing in Tornado httputil

Vulnerability ID: CVE-2025-67726
CVSS Score: 7.5
Published: 2026-07-20

A denial of service vulnerability in Tornado versions 6.5.2 and below arises from excessive iteration in its parameter parser. The _parseparam function in httputil.py parses parameters in HTTP headers using an inefficient nested loop that counts double quotes from index zero. This implementation exposes a quadratic $O(n^2)$ complexity curve when processing quoted headers containing a high volume of semicolons, leading to CPU exhaustion and blocking the asynchronous event loop.

TL;DR

Tornado web framework versions before 6.5.3 use an inefficient algorithm to parse header values, allowing unauthenticated remote attackers to cause a complete Denial of Service via CPU exhaustion with a single crafted request.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-834 / CWE-400
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 7.5 (High)
  • EPSS Score: 0.00378
  • Exploit Status: Proof of Concept
  • Impact: Denial of Service (DoS)
  • Remediation: Upgrade to Tornado v6.5.3

Affected Systems

  • tornadoweb/tornado
  • Tornado: < 6.5.3 (Fixed in: 6.5.3)

Code Analysis

Commit: 771472c

Optimize parameter parsing in httputil to prevent quadratic time complexity DoS.

Mitigation Strategies

  • Upgrade Tornado framework to version 6.5.3 or higher.
  • Deploy Web Application Firewall (WAF) rules to filter content-disposition headers containing excessive semicolons.
  • Restrict HTTP header size and multipart parameter count at the reverse proxy layer.

Remediation Steps:

  1. Run 'pip install --upgrade tornado>=6.5.3' to apply the official patch.
  2. Restart the Tornado application services to load the updated package.
  3. Verify the fix by running an automated regression test script to measure parameter parsing growth.

References

Read the full report for CVE-2025-67726 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)