CVE-2025-67726: 
Python vulnerability analysis and mitigation

CVE-2025-67726 is a Denial of Service (DoS) vulnerability in the Tornado Python web framework caused by quadratic CPU consumption when parsing crafted multipart/form-data HTTP headers. It affects all versions of Tornado prior to 6.5.3. The vulnerability was reported by security researcher Finder16, disclosed on December 11–12, 2025, and fixed in version 6.5.3 released on December 10, 2025. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Tornado Release).

The root cause is an inefficient parsing algorithm in the _parseparam function within tornado/httputil.py, classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-834 (Excessive Iteration). The function, used to parse HTTP header values such as Content-Disposition in multipart/form-data requests, repeatedly calls string.count() within a nested loop when processing quoted semicolons (e.g., param=";"), resulting in O(n²) time complexity as the number of crafted parameters grows. An unauthenticated remote attacker can send a single HTTP request with a large number of maliciously crafted parameters in the Content-Disposition header to trigger this behavior. The fix, committed in 771472c, adapts logic from CPython's equivalent fix to achieve linear parsing performance (GitHub Advisory, Patch Commit).

Successful exploitation causes the Tornado server's CPU usage to spike quadratically, rendering the entire server unresponsive for an extended period. Because Tornado uses a single-threaded event loop architecture, a single malicious request is sufficient to block all other request processing, effectively creating a complete availability outage. There is no impact on confidentiality or data integrity — the vulnerability is purely a Denial of Service condition (GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it trivially exploitable by any network-accessible attacker once a target is identified. The EPSS score is approximately 0.049% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing services running Tornado versions prior to 6.5.3 using tools like Shodan or Censys, or by inspecting HTTP response headers for Tornado version indicators.
2. Craft malicious request: Construct an HTTP POST request targeting any endpoint that processes multipart/form-data bodies. Set the Content-Type header to multipart/form-data; boundary=1234.
3. Build malicious Content-Disposition header: In the multipart body, include a Content-Disposition header with a parameter value containing a very large number of semicolons within a quoted string, e.g., Content-Disposition: form-data; x=" followed by thousands of ; characters, then "; name="files"; filename="a.txt".
4. Send the request: Transmit the crafted request to the target server. The _parseparam function will enter O(n²) processing, consuming excessive CPU.
5. Achieve DoS: Due to Tornado's single event loop, the server becomes unresponsive to all other requests for an extended period, achieving a Denial of Service condition (GitHub Advisory, Patch Commit).

• Network: Unusual HTTP POST requests to multipart/form-data endpoints with abnormally large Content-Disposition headers containing many semicolons within quoted strings; single requests with unusually large body sizes targeting file upload or form endpoints.
• Logs: Tornado access logs showing requests with Content-Type: multipart/form-data that result in prolonged response times or timeouts; repeated requests from the same source IP to form-processing endpoints.
• Process: Sustained high CPU utilization (near 100%) on the Tornado server process with no corresponding increase in request throughput; server event loop latency metrics spiking dramatically for a single request.

The primary remediation is to upgrade Tornado to version 6.5.3 or later, which fixes the quadratic parsing behavior in _parseparam (Tornado Release). IBM has also released patches for affected products including Data Virtualization on IBM Software Hub and IBM Db2 on Cloud Pak for Data (IBM Advisory). As interim mitigations, operators should implement network-level controls to limit request body sizes and rate-limit requests to multipart/form-data endpoints, and monitor server CPU usage for anomalous spikes.

The vulnerability was reported by researcher Finder16 and acknowledged by Tornado maintainer bdarnell, who published the fix and security advisory on December 11, 2025. Multiple Linux distributions including SUSE, Ubuntu, Debian, Red Hat, AlmaLinux, and Rocky Linux have issued security advisories and updated packages. IBM has published bulletins for several affected enterprise products. The vulnerability has been picked up by standard vulnerability tracking platforms (Vulners, VulDB, CIRCL) and security scanner vendors (Tenable Nessus, Qualys) have released detection plugins (GitHub Advisory, IBM Advisory).