Tornado: Quadratic DoS via Crafted Multipart Parameters

CAO 7.5CVE-2025-67726 · GHSA-jhmp-mqwm-3gq8 · PYSEC-2025-267 · Công bố 12/12/2025 · cập nhật 07/10/2026

Tóm tắt nhanh

CVE-2025-67726 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng tornado, tornado (tornadoweb).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.53%, cao hơn 45.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 6.5.3 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
tornado PyPI	`< 6.5.3`	`6.5.3`
tornado tornadoweb	`< 6.5.3`	`6.5.3`

Mô tả

Summary

The _parseparam function in Tornado's httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data. This function uses an inefficient algorithm that repeatedly calls string.count() within a nested loop while processing quoted semicolons (e.g., param=";").

As a result, if an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period, leading to a Denial of Service (DoS).

Severity: High

Mô tả của NVD

Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.