{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/tornado-project/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2025-67726"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Tornado (\u003c 6.5.3)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","web-application","python"],"_cs_type":"advisory","_cs_vendors":["Tornado Project"],"content_html":"\u003cp\u003eA high-severity Denial of Service (DoS) vulnerability, tracked as CVE-2025-67726, exists in the Tornado web framework, affecting versions prior to 6.5.3. This vulnerability stems from an inefficient algorithm within the \u003ccode\u003e_parseparam\u003c/code\u003e function located in \u003ccode\u003ehttputil.py\u003c/code\u003e, which is responsible for parsing HTTP header values such as those found in \u003ccode\u003emultipart/form-data\u003c/code\u003e requests. Specifically, the function repeatedly calls \u003ccode\u003estring.count()\u003c/code\u003e within a nested loop when processing quoted semicolons (e.g., \u003ccode\u003eparam=\u0026quot;;\u0026quot;\u003c/code\u003e). An attacker can exploit this by sending a crafted HTTP request containing a large number of such parameters in a \u003ccode\u003eContent-Disposition\u003c/code\u003e header. This triggers a quadratic increase (O(n²)) in server CPU usage during parsing. Due to Tornado's single event loop architecture, a single malicious request can render the entire server unresponsive for an extended period, leading to a complete DoS.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a web server running an unpatched Tornado instance, specifically versions prior to 6.5.3.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious HTTP request intended to exploit the \u003ccode\u003e_parseparam\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe request includes a \u003ccode\u003eContent-Disposition\u003c/code\u003e header, typically found within \u003ccode\u003emultipart/form-data\u003c/code\u003e requests.\u003c/li\u003e\n\u003cli\u003eWithin this \u003ccode\u003eContent-Disposition\u003c/code\u003e header, the attacker embeds a large quantity of specially crafted parameters.\u003c/li\u003e\n\u003cli\u003eThese parameters are designed to leverage quoted semicolons (e.g., \u003ccode\u003efilename=\u0026quot;data;a=b;c=d;;\u0026quot;\u003c/code\u003e), which trigger the inefficient parsing logic.\u003c/li\u003e\n\u003cli\u003eUpon receiving the malicious request, the vulnerable Tornado server initiates parsing of the \u003ccode\u003eContent-Disposition\u003c/code\u003e header using the \u003ccode\u003e_parseparam\u003c/code\u003e function in \u003ccode\u003ehttputil.py\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe quadratic time complexity (O(n²)) of \u003ccode\u003e_parseparam\u003c/code\u003e when processing these crafted parameters consumes excessive CPU resources.\u003c/li\u003e\n\u003cli\u003eDue to Tornado's single event loop architecture, the server becomes unresponsive to legitimate requests, resulting in a Denial of Service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2025-67726 leads to a complete Denial of Service for the affected Tornado web server. The server's CPU usage increases quadratically, rendering it unresponsive and unable to process legitimate requests. This can cause significant disruption to services, downtime, and potential data loss for applications reliant on the vulnerable Tornado instance. The impact is primarily on the availability of the web service.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2025-67726 immediately by upgrading all Tornado installations to version 6.5.3 or later.\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) or intrusion prevention system (IPS) capable of inspecting and blocking HTTP requests with abnormally large or malformed \u003ccode\u003eContent-Disposition\u003c/code\u003e headers containing repeated quoted semicolons, to mitigate attacks against CVE-2025-67726 before patching is complete.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T18:58:57Z","date_published":"2026-07-20T18:58:57Z","id":"https://feed.craftedsignal.io/briefs/2026-07-20-tornado-quadratic-dos/","summary":"A high-severity quadratic time complexity vulnerability (CVE-2025-67726) in Tornado's `_parseparam` function allows an attacker to cause a Denial of Service (DoS) by sending crafted `multipart/form-data` requests with malicious parameters in the `Content-Disposition` header to vulnerable Tornado web servers versions prior to 6.5.3.","title":"Tornado Web Server Quadratic DoS Vulnerability (CVE-2025-67726)","url":"https://feed.craftedsignal.io/briefs/2026-07-20-tornado-quadratic-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Tornado Project","version":"https://jsonfeed.org/version/1.1"}