CVE-2025-67725: 
Python vulnerability analysis and mitigation

CVE-2025-67725 is a Denial of Service (DoS) vulnerability in the Tornado Python web framework caused by quadratic time complexity when processing repeated HTTP headers. The HTTPHeaders.add method accumulates values via string concatenation when the same header name appears multiple times; due to Python string immutability, each concatenation copies the entire string, resulting in O(n²) complexity that can block Tornado's single-threaded event loop. All versions prior to 6.5.3 are affected. The vulnerability was disclosed on December 11–12, 2025, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption). The vulnerable code path is in the HTTPHeaders.add method, which uses naive string concatenation to coalesce repeated header values — an O(n²) operation due to Python's immutable string model. An unauthenticated remote attacker can send a single crafted HTTP request containing a large number of repeated header names (up to the max_header_size limit, defaulting to 64 KB) to trigger excessive CPU consumption and stall the event loop. A related fix was also applied to the _parseparam function in httputil.py, which exhibited the same quadratic behavior when parsing semicolons within quoted strings in Content-Disposition headers (GitHub Advisory, Patch Commit).

Successful exploitation causes availability degradation or complete service interruption of the Tornado-based application. Because Tornado uses a single-threaded event loop, blocking it with one malicious request prevents all other requests from being processed, effectively rendering the service unresponsive. There is no confidentiality or integrity impact. The severity scales with the max_header_size configuration: high impact if the limit has been increased beyond the default 64 KB, and lower impact at the default setting (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires no authentication, no user interaction, and no special privileges — only network access to a Tornado server. The EPSS score is approximately 0.57%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify internet-facing services running Tornado (versions < 6.5.3) using banner analysis, HTTP response headers, or tools like Shodan/Censys.
2. Craft malicious request: Construct an HTTP request containing a very large number of repeated identical header names (e.g., X-Custom-Header: value1\r\nX-Custom-Header: value2\r\n...) up to or near the server's max_header_size limit.
3. Send the request: Transmit the crafted request to any HTTP endpoint exposed by the Tornado server. No authentication or special path is required.
4. Trigger event loop block: The HTTPHeaders.add method processes the repeated headers with O(n²) string concatenation, consuming excessive CPU and blocking Tornado's event loop for an extended period.
5. Achieve DoS: While the event loop is blocked, all other incoming requests are queued or dropped, causing service unavailability (GitHub Advisory).

• Network: Unusual HTTP requests with a high number of repeated header names directed at any Tornado endpoint; single requests with header sections approaching the max_header_size limit.
• Logs: Tornado access logs showing requests with abnormally large or repetitive header sections; application logs indicating event loop latency spikes or timeout errors coinciding with specific client IPs.
• Process: Sudden spike in CPU usage by the Tornado Python process without a corresponding increase in request throughput; event loop lag metrics exceeding normal thresholds.
• Availability: Sudden unresponsiveness of the Tornado application to all clients immediately following receipt of a specific request.

Upgrade Tornado to version 6.5.3 or later, which resolves the quadratic behavior in both HTTPHeaders.add and _parseparam (Tornado Release, Patch Commit). If an immediate upgrade is not feasible, consider the following interim mitigations: (1) ensure max_header_size is not increased beyond its default 64 KB value to limit the attack surface; (2) deploy a reverse proxy or WAF in front of Tornado to detect and drop requests with excessive repeated headers; (3) apply strict rate limiting and connection timeouts at the network edge. IBM has also released advisories for affected products (Data Virtualization on IBM Software Hub, Cloudera Data Platform with IBM) that bundle Tornado (IBM Advisory).

The vulnerability was reported by security researcher Finder16 and disclosed via GitHub Security Advisories by Tornado maintainer bdarnell on December 11, 2025 (GitHub Advisory). Multiple Linux distributions — including Ubuntu, Debian, SUSE/openSUSE, Red Hat, AlmaLinux, Rocky Linux, and Amazon Linux — have issued security advisories and updated their Tornado packages. IBM published advisories for downstream products affected by this vulnerability. Community discussion has been limited, reflecting the moderate severity and lack of active exploitation.