Skip to content
Threat Feed
Subscribe

Vendor

Tornado Project

1 brief RSS
low advisory

Tornado Web Server Quadratic DoS Vulnerability (CVE-2025-67726)

A high-severity quadratic time complexity vulnerability (CVE-2025-67726) in Tornado's `_parseparam` function allows an attacker to cause a Denial of Service (DoS) by sending crafted `multipart/form-data` requests with malicious parameters in the `Content-Disposition` header to vulnerable Tornado web servers versions prior to 6.5.3.

Tornado denial-of-service vulnerability web-application python
1t 1c