CVE-2025-67726
📋 TL;DR
CVE-2025-67726 is a denial-of-service vulnerability in Tornado web framework where inefficient parsing of HTTP header parameters allows attackers to cause quadratic CPU consumption. This affects Tornado servers running versions 6.5.2 and below, potentially making them unresponsive to legitimate traffic.
💻 Affected Systems
- Tornado web framework
📦 What is this software?
Tornado by Tornadoweb
⚠️ Risk & Real-World Impact
Worst Case
Complete server unavailability for extended periods due to CPU exhaustion from a single malicious request, affecting all users and services on the same Tornado instance.
Likely Case
Degraded server performance and intermittent service disruptions when attackers send crafted requests with many parameters in Content-Disposition headers.
If Mitigated
Minimal impact with proper rate limiting, request filtering, and updated Tornado version.
🎯 Exploit Status
Exploitation requires sending HTTP requests with malicious Content-Disposition headers containing many parameters. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.5.3
Vendor Advisory: https://github.com/tornadoweb/tornado/security/advisories/GHSA-jhmp-mqwm-3gq8
Restart Required: Yes
Instructions:
1. Update Tornado using pip: 'pip install --upgrade tornado==6.5.3' 2. Restart all Tornado services 3. Verify the update with 'pip show tornado'
🔧 Temporary Workarounds
Rate limiting requests
allImplement request rate limiting to prevent multiple malicious requests from overwhelming the server
# Use nginx rate limiting: limit_req_zone $binary_remote_addr zone=tornado:10m rate=10r/s;
# Add to location block: limit_req zone=tornado burst=20 nodelay;
Request filtering with WAF
allBlock requests with excessive Content-Disposition parameters using web application firewall rules
# Example ModSecurity rule: SecRule REQUEST_HEADERS:Content-Disposition "@rx ;.*;.*;.*;.*;.*" "id:1001,phase:1,deny,status:400"
🧯 If You Can't Patch
- Implement strict request size limits and parameter count validation
- Deploy Tornado behind reverse proxy with request filtering and anomaly detection
🔍 How to Verify
Check if Vulnerable:
Check Tornado version with 'python -c "import tornado; print(tornado.version)"' and verify it's 6.5.2 or belowCheck Version:
python -c "import tornado; print('Tornado version:', tornado.version)"Verify Fix Applied:
Confirm version is 6.5.3 or higher with 'pip show tornado | grep Version'📡 Detection & Monitoring
Log Indicators:
- Unusually long request processing times
- High CPU usage spikes
- Requests with Content-Disposition headers containing many semicolons
Network Indicators:
- HTTP requests with abnormally large Content-Disposition headers
- Multiple requests with similar patterns causing server slowdown
SIEM Query:
source="tornado.logs" | where request_time > 10s | where http_user_agent contains suspicious patterns