CVE-2025-67726

Name of the Vulnerable Software and Affected Versions Tornado versions 6.5.2 and below

Description Tornado, a Python web framework and asynchronous networking library, is susceptible to a denial-of-service (DoS) condition. The parseparam function within the httputil.py file utilizes an inefficient algorithm when parsing parameters in HTTP header values, specifically when handling multipart/form-data. Repeated calls to string.count() within a nested loop, while processing quoted semicolons, lead to quadratic time complexity (O(n²)) when parsing maliciously crafted parameters in a Content-Disposition header. This can cause the server to become unresponsive due to Tornado’s single event loop architecture.

Recommendations Update to Tornado version 6.5.3 or later.