{"vulnerability": "cve-2025-6772", "sightings": [{"uuid": "396701d0-3875-4485-8668-85d182c6a1c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-6772", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lsmiin3m4723", "content": "", "creation_timestamp": "2025-06-27T20:35:09.640301Z"}, {"uuid": "b37beb97-a00f-4159-ab83-71a6eabe6fed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67723", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mdizzbgsgm2j", "content": "", "creation_timestamp": "2026-01-28T19:46:20.133501Z"}, {"uuid": "88d0f021-c97c-498a-8c2f-e8fa8cb87db4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67720", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3m7on2ctqum2x", "content": "", "creation_timestamp": "2025-12-11T03:29:28.661802Z"}, {"uuid": "432e3627-4c1e-4674-b6d6-2e8c1fa63619", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67726", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3m7rkeyxwtm2e", "content": "", "creation_timestamp": "2025-12-12T07:19:45.197561Z"}, {"uuid": "03e2a7f3-345d-4702-a729-6bf06fcdf471", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67727", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3m7rl3qjufj2q", "content": "", "creation_timestamp": "2025-12-12T07:32:27.961473Z"}, {"uuid": "2a1289db-c22a-417b-b9b5-e11db0fc0cc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-67728", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/115705438603812840", "content": "", "creation_timestamp": "2025-12-12T07:34:42.588363Z"}, {"uuid": "f537f53b-4141-42ab-8889-6272bffa7394", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-67728", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3m7rl7reqiu2g", "content": "", "creation_timestamp": "2025-12-12T07:34:43.601679Z"}, {"uuid": "f43199ec-4fa6-4c1a-81f4-a2fba17871a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67725", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3m7rmkxia4i2y", "content": "", "creation_timestamp": "2025-12-12T07:58:52.614029Z"}, {"uuid": "56866287-fb18-4090-8265-e5da26d279a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67727", "type": "seen", "source": "https://gist.github.com/Darkcrai86/336c80a608d1c680c71671df6cccc755", "content": "", "creation_timestamp": "2025-12-12T08:10:38.000000Z"}, {"uuid": "e66f7014-0f5c-4ea2-8475-f2bfb1a24a93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67728", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3m7rpqyjbso2u", "content": "", "creation_timestamp": "2025-12-12T08:55:56.211349Z"}, {"uuid": "5f4908c6-2760-4785-8916-12485f0731ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67721", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3m7tn7qf5hb22", "content": "", "creation_timestamp": "2025-12-13T03:15:49.165185Z"}, {"uuid": "c241f722-1f41-4d29-8d77-b077c6c1c0dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67722", "type": "seen", "source": "https://gist.github.com/Darkcrai86/4a431d0bf61ea9d21d19c093066d89eb", "content": "", "creation_timestamp": "2025-12-16T08:02:48.000000Z"}, {"uuid": "2b06ea0f-3481-40e2-bd55-d9cba0e7c497", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67729", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mawdw7x6fm2y", "content": "", "creation_timestamp": "2025-12-26T22:32:53.127051Z"}, {"uuid": "bf34ac6f-e101-4b5a-adb0-0a2b8650d342", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67724", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mdv5xgez6k2i", "content": "", "creation_timestamp": "2026-02-02T15:28:54.975692Z"}, {"uuid": "c074ce93-9697-415f-b9f8-d8525424fe8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67725", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mdv5xgez6k2i", "content": "", "creation_timestamp": "2026-02-02T15:28:55.082325Z"}, {"uuid": "58e22614-dae0-4699-a064-0b2efd3fd011", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67724", "type": "seen", "source": "https://bsky.app/profile/bluesky.awakari.com/post/3mbxc4hgw5h2p", "content": "", "creation_timestamp": "2026-01-09T00:58:10.815232Z"}, {"uuid": "a4e0d57a-3ba7-4644-934e-ed2d02e03a18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67724", "type": "seen", "source": "https://bsky.app/profile/Ubuntu.activitypub.awakari.com.ap.brid.gy/post/3mbxc6dfkbdb2", "content": "", "creation_timestamp": "2026-01-09T01:04:57.483207Z"}, {"uuid": "571ff8ef-4790-48f5-a88b-e95b67442f64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67724", "type": "seen", "source": "https://gist.github.com/Darkcrai86/15e3ce0d24e7ea1a4a0dd1357e6e88ca", "content": "", "creation_timestamp": "2026-01-09T09:30:09.000000Z"}, {"uuid": "3cddacfa-fc6a-40be-850a-6b7af7b80543", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67724", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mbyu4d6qus2f", "content": "", "creation_timestamp": "2026-01-09T15:52:58.016435Z"}, {"uuid": "255178d3-8034-47c4-89bb-265e5d05ee17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-6772", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/19777", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-6772\n\ud83d\udd25 CVSS Score: 6.9 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P)\n\ud83d\udd39 Description: A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2. It has been classified as critical. Affected is the function import_flow of the file /api/v2/serve/awel/flow/import. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.\n\ud83d\udccf Published: 2025-06-27T18:31:05.585Z\n\ud83d\udccf Modified: 2025-06-27T18:31:05.585Z\n\ud83d\udd17 References:\n1. https://vuldb.com/?id.314088\n2. https://vuldb.com/?ctiid.314088\n3. https://vuldb.com/?submit.601028\n4. https://github.com/eosphoros-ai/DB-GPT/issues/2774", "creation_timestamp": "2025-06-27T18:51:50.000000Z"}, {"uuid": "f20f21f9-b89e-4125-883d-cfa83729c832", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-67729", "type": "published-proof-of-concept", "source": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-9pf3-7rrr-x5jh", "content": "", "creation_timestamp": "2025-12-26T03:14:40.000000Z"}, {"uuid": "b7449eb9-66e8-4f7f-94c7-b2b88d278380", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-67720", "type": "published-proof-of-concept", "source": "https://github.com/Mayuri-Chan/pyrofork/security/advisories/GHSA-6h2f-wjhf-4wjx", "content": "", "creation_timestamp": "2025-12-10T18:36:27.000000Z"}, {"uuid": "286c4105-078d-49c9-bd83-1fee1c646767", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-67726", "type": "seen", "source": "https://gist.github.com/alon710/406a76bb8aa1f3068e2e86792c104d53", "content": "# CVE-2025-67726: CVE-2025-67726: Denial of Service via Quadratic Parameter Parsing in Tornado httputil\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/CVE-2025-67726\n\n## Summary\nA denial of service vulnerability in Tornado versions 6.5.2 and below arises from excessive iteration in its parameter parser. The `_parseparam` function in `httputil.py` parses parameters in HTTP headers using an inefficient nested loop that counts double quotes from index zero. This implementation exposes a quadratic $O(n^2)$ complexity curve when processing quoted headers containing a high volume of semicolons, leading to CPU exhaustion and blocking the asynchronous event loop.\n\n## TL;DR\nTornado web framework versions before 6.5.3 use an inefficient algorithm to parse header values, allowing unauthenticated remote attackers to cause a complete Denial of Service via CPU exhaustion with a single crafted request.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-834 / CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.00378\n- **Exploit Status**: Proof of Concept\n- **Impact**: Denial of Service (DoS)\n- **Remediation**: Upgrade to Tornado v6.5.3\n\n## Affected Systems\n\n- tornadoweb/tornado\n- **Tornado**: < 6.5.3 (Fixed in: `6.5.3`)\n\n## Mitigation\n\n- Upgrade Tornado framework to version 6.5.3 or higher.\n- Deploy Web Application Firewall (WAF) rules to filter content-disposition headers containing excessive semicolons.\n- Restrict HTTP header size and multipart parameter count at the reverse proxy layer.\n\n**Remediation Steps:**\n1. Run 'pip install --upgrade tornado>=6.5.3' to apply the official patch.\n2. Restart the Tornado application services to load the updated package.\n3. Verify the fix by running an automated regression test script to measure parameter parsing growth.\n\n## References\n\n- [GHSA-jhmp-mqwm-3gq8](https://github.com/tornadoweb/tornado/security/advisories/GHSA-jhmp-mqwm-3gq8)\n- [Tornado Fix Commit 771472c](https://github.com/tornadoweb/tornado/commit/771472cfdaeebc0d89a9cc46e249f8891a6b29cd)\n- [Tornado v6.5.3 Release Notes](https://github.com/tornadoweb/tornado/releases/tag/v6.5.3)\n- [Upstream CPython Pull Request 136072](https://github.com/python/cpython/pull/136072/files)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2025-67726) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-20T19:31:55.389196Z"}]}