CVE-2025-67725

{"id": "CVE-2025-67725", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67725", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-18T18:50:52.619221Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "tornadoweb", "product": "tornado", "versions": [{"status": "affected", "version": "< 6.5.3"}]}]}], "published": "2025-12-12T06:15:41.380", "references": [{"url": "https://github.com/tornadoweb/tornado/commit/771472cfdaeebc0d89a9cc46e249f8891a6b29cd", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/tornadoweb/tornado/releases/tag/v6.5.3", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-c98p-7wgm-6p64", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same header name is repeated, causing a Denial of Service (DoS). Due to Python string immutability, each concatenation copies the entire string, resulting in O(n\u00b2) time complexity. The severity can vary from high if max_header_size has been increased from its default, to low if it has its default value of 64KB. This issue is fixed in version 6.5.3."}, {"lang": "es", "value": "Tornado es un framework web de Python y una biblioteca de red as\u00edncrona. En las versiones 6.5.2 e inferiores, una \u00fanica solicitud HTTP maliciosa puede bloquear el bucle de eventos del servidor durante un per\u00edodo prolongado, causado por el m\u00e9todo HTTPHeaders.add. La funci\u00f3n acumula valores usando la concatenaci\u00f3n de cadenas cuando el mismo nombre de encabezado se repite, causando una Denegaci\u00f3n de Servicio (DoS). Debido a la inmutabilidad de las cadenas de Python, cada concatenaci\u00f3n copia la cadena completa, lo que resulta en una complejidad de tiempo de O(n\u00b2). La severidad puede variar de alta si max_header_size se ha aumentado de su valor predeterminado, a baja si tiene su valor predeterminado de 64KB. Este problema est\u00e1 solucionado en la versi\u00f3n 6.5.3."}], "lastModified": "2026-10-07T20:10:01.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64279E50-159B-4CAB-9BD0-E2B764C3C40C", "versionEndExcluding": "6.5.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}