{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/tornado/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2025-67725"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Tornado (\u003c 6.5.3)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","web-vulnerability","python","tornado"],"_cs_type":"advisory","_cs_vendors":["Tornado Web Server"],"content_html":"\u003cp\u003eA significant Denial of Service (DoS) vulnerability, tracked as CVE-2025-67725, has been identified in the \u003ccode\u003eHTTPHeaders.add\u003c/code\u003e method of the Tornado web server framework, affecting versions prior to 6.5.3. This vulnerability stems from the inefficient handling of repeated HTTP header names. When the same header name is used multiple times in an HTTP request, Tornado's \u003ccode\u003eadd\u003c/code\u003e method uses string concatenation to accumulate values. Due to the immutable nature of strings in Python, each concatenation operation creates a new string object, leading to an O(n²) time complexity for processing the headers. Given Tornado's single event loop architecture, a single, specially crafted HTTP request containing an excessive number of repeated header names can consume substantial CPU resources, effectively blocking the event loop and causing a sustained DoS for legitimate users. The severity of this vulnerability is considered high if the \u003ccode\u003emax_header_size\u003c/code\u003e configuration has been increased from its default 64KB, as this allows larger, more impactful malicious requests to be processed.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts an HTTP request specifically designed with an unusually high number of repeated header names.\u003c/li\u003e\n\u003cli\u003eThe attacker sends this maliciously crafted HTTP request to a vulnerable Tornado server instance.\u003c/li\u003e\n\u003cli\u003eThe Tornado server receives the HTTP request and begins processing its headers using the \u003ccode\u003eHTTPHeaders.add\u003c/code\u003e method.\u003c/li\u003e\n\u003cli\u003eDuring header processing, the \u003ccode\u003eadd\u003c/code\u003e method attempts to concatenate the values for the repeated header names.\u003c/li\u003e\n\u003cli\u003eDue to Python's string immutability, each concatenation step results in the creation of a new string object, leading to quadratic (O(n²)) time complexity as the number of repeated headers increases.\u003c/li\u003e\n\u003cli\u003eThis computationally intensive operation consumes significant CPU resources, causing the server's single event loop to become unresponsive or significantly delayed.\u003c/li\u003e\n\u003cli\u003eThe blocking of the event loop prevents the Tornado server from processing other incoming requests, resulting in a Denial of Service for all clients.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2025-67725 results in a Denial of Service (DoS) for the affected Tornado web server and its clients. Attackers can render the server inaccessible or severely degrade its performance by sending a single, malformed HTTP request. The impact severity is particularly high if the \u003ccode\u003emax_header_size\u003c/code\u003e configuration setting in the Tornado server has been increased from its default value of 64KB, as this allows for larger malicious requests to be processed, exacerbating the O(n²) overhead. Organizations using vulnerable Tornado versions are at risk of service disruption, lost revenue, and reputational damage.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2025-67725 by upgrading your \u003ccode\u003epip/tornado\u003c/code\u003e package to version 6.5.3 or later immediately.\u003c/li\u003e\n\u003cli\u003eReview your Tornado server configuration to ensure \u003ccode\u003emax_header_size\u003c/code\u003e is set to its default value or an appropriate limit to mitigate the potential impact of large malicious headers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T18:59:34Z","date_published":"2026-07-20T18:59:34Z","id":"https://feed.craftedsignal.io/briefs/2026-07-tornado-quadratic-dos/","summary":"A quadratic Denial of Service (DoS) vulnerability exists in Tornado's `HTTPHeaders.add` method due to inefficient string concatenation for repeated header names, which, when processing a maliciously crafted HTTP request with numerous repeated headers, can block the server's single event loop for an extended period, leading to a high severity DoS if `max_header_size` is increased from its default 64KB.","title":"Tornado Quadratic DoS via Repeated HTTP Header Coalescing (CVE-2025-67725)","url":"https://feed.craftedsignal.io/briefs/2026-07-tornado-quadratic-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Tornado","version":"https://jsonfeed.org/version/1.1"}