CVE-2025-67724

Name of the Vulnerable Software and Affected Versions Tornado versions 6.5.2 and below

Description Tornado, a Python web framework and asynchronous networking library, has an issue where the reason phrase supplied to functions like RequestHandler.set status and tornado.web.HTTPError is used without proper escaping. This can lead to header injection when used in HTTP headers and cross-site scripting (XSS) when displayed in the default error page's HTML. The reason argument is intended for custom HTTP status phrases. Exploitation involves providing untrusted or malicious data as the reason argument.

Recommendations Versions prior to 6.5.3 should be updated to version 6.5.3 or later.