{"uuid": "286c4105-078d-49c9-bd83-1fee1c646767", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67726", "type": "seen", "source": "https://gist.github.com/alon710/406a76bb8aa1f3068e2e86792c104d53", "content": "# CVE-2025-67726: CVE-2025-67726: Denial of Service via Quadratic Parameter Parsing in Tornado httputil\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/CVE-2025-67726\n\n## Summary\nA denial of service vulnerability in Tornado versions 6.5.2 and below arises from excessive iteration in its parameter parser. The `_parseparam` function in `httputil.py` parses parameters in HTTP headers using an inefficient nested loop that counts double quotes from index zero. This implementation exposes a quadratic $O(n^2)$ complexity curve when processing quoted headers containing a high volume of semicolons, leading to CPU exhaustion and blocking the asynchronous event loop.\n\n## TL;DR\nTornado web framework versions before 6.5.3 use an inefficient algorithm to parse header values, allowing unauthenticated remote attackers to cause a complete Denial of Service via CPU exhaustion with a single crafted request.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-834 / CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.00378\n- **Exploit Status**: Proof of Concept\n- **Impact**: Denial of Service (DoS)\n- **Remediation**: Upgrade to Tornado v6.5.3\n\n## Affected Systems\n\n- tornadoweb/tornado\n- **Tornado**: < 6.5.3 (Fixed in: `6.5.3`)\n\n## Mitigation\n\n- Upgrade Tornado framework to version 6.5.3 or higher.\n- Deploy Web Application Firewall (WAF) rules to filter content-disposition headers containing excessive semicolons.\n- Restrict HTTP header size and multipart parameter count at the reverse proxy layer.\n\n**Remediation Steps:**\n1. Run 'pip install --upgrade tornado>=6.5.3' to apply the official patch.\n2. Restart the Tornado application services to load the updated package.\n3. Verify the fix by running an automated regression test script to measure parameter parsing growth.\n\n## References\n\n- [GHSA-jhmp-mqwm-3gq8](https://github.com/tornadoweb/tornado/security/advisories/GHSA-jhmp-mqwm-3gq8)\n- [Tornado Fix Commit 771472c](https://github.com/tornadoweb/tornado/commit/771472cfdaeebc0d89a9cc46e249f8891a6b29cd)\n- [Tornado v6.5.3 Release Notes](https://github.com/tornadoweb/tornado/releases/tag/v6.5.3)\n- [Upstream CPython Pull Request 136072](https://github.com/python/cpython/pull/136072/files)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2025-67726) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-20T19:31:55.389196Z"}