CVE-2025-67725
📋 TL;DR
A denial-of-service vulnerability in Tornado web framework allows a single malicious HTTP request to block the server's event loop by exploiting inefficient string concatenation in the HTTPHeaders.add method. This affects Tornado versions 6.5.2 and below, potentially causing service disruption. The severity depends on configuration, with higher risk when max_header_size is increased beyond the default 64KB.
💻 Affected Systems
- Tornado
📦 What is this software?
Tornado by Tornadoweb
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability for extended periods due to event loop blocking, potentially affecting all users of the vulnerable Tornado application.
Likely Case
Degraded performance or temporary service disruption for the affected Tornado instance, with recovery after the malicious request completes.
If Mitigated
Minimal impact if max_header_size remains at default 64KB, though some performance degradation may still occur.
🎯 Exploit Status
Exploitation requires sending a single HTTP request with repeated headers to trigger the inefficient string concatenation. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.5.3
Vendor Advisory: https://github.com/tornadoweb/tornado/security/advisories/GHSA-c98p-7wgm-6p64
Restart Required: Yes
Instructions:
1. Update Tornado to version 6.5.3 or higher using pip: pip install --upgrade tornado>=6.5.3
2. Restart all Tornado applications and services
3. Verify the update was successful
🔧 Temporary Workarounds
Rate Limiting
allImplement rate limiting or request throttling to limit the impact of malicious requests
Header Size Restriction
allEnsure max_header_size remains at default 64KB or lower to reduce impact
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block requests with excessive repeated headers
- Deploy Tornado behind a reverse proxy with request filtering capabilities
🔍 How to Verify
Check if Vulnerable:
Check Tornado version: python -c "import tornado; print(tornado.version)" - if version is 6.5.2 or below, system is vulnerableCheck Version:
python -c "import tornado; print(tornado.version)"Verify Fix Applied:
After patching, verify version is 6.5.3 or higher using the same command📡 Detection & Monitoring
Log Indicators:
- Unusually long request processing times
- Multiple requests with same header names repeated many times
- Event loop blocking warnings
Network Indicators:
- HTTP requests with same header repeated hundreds or thousands of times
- Sudden increase in request size without corresponding response
SIEM Query:
source="tornado" AND (duration>10s OR header_count>100)