GitHub Advisoryadvisory · PyPI

GHSA-c98p-7wgm-6p64 Tornado: Quadratic DoS via Repeated Header Coalescing

HIGH Published 2026-07-20 Modified 2026-07-20 Official page ↗
Aliases
CVE-2025-67725
Ecosystem
PyPI
Packages
tornado
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2026-07-20

Affected packages

• PyPI tornado: < 6.5.3 → fixed in 6.5.3

Description

Summary The `HTTPHeaders.add` method in Tornado accumulates values using string concatenation when the same header name is repeated. Due to Python string immutability, each concatenation copies the entire string, resulting in O(n²) time complexity. Given Tornado's single event loop architecture, a single maliciously crafted HTTP request can block the server's event loop for an extended period, causing a Denial of Service (DoS). Severity: High if `max_header_size` has been increased from its default, low if it has its default value of 64KB.

Related

Alias · CVE (1)

  • CVE-2025-67725 Tornado is a Python web framework and asynchronous networking library. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References