CVE-2025-67724: Tornado header injection and XSS in reason argument

CVE-2025-67724 · Severity: medium · CVSS 5.4 · Published 2025-12-12

Tornado, a popular Python web framework and networking library, is vulnerable to attacks that could allow malicious actors to inject unauthorized web headers or execute malicious scripts in a user's browser. This occurs when an application uses untrusted data to define custom HTTP error messages. If exploited, this could lead to unauthorized actions on behalf of users, such as stealing session information or redirecting users to malicious websites.

Technologies: tornado (PyPI), Tornadoweb Tornado. Vendors: PyPI, Tornadoweb.

Quick answers

Is CVE-2025-67724 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-67724 being exploited in the wild.
How severe is CVE-2025-67724?
Medium severity, with a CVSS score of 5.4, published 12 December 2025.
Which products and versions are affected?
tornado (PyPI) < 6.5.3, ECOSYSTEM:introduced=0,fixed=6.5.3.
Is there a fix for CVE-2025-67724?
Yes. tornado (PyPI): upgrade to 6.5.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-67724 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-67724?
Check whether you run tornado (PyPI) or Tornadoweb Tornado at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • tornado (PyPI): upgrade to 6.5.3 or later
    pip install "tornado>=6.5.3"

Technical details

Tornado versions prior to 6.5.3 fail to properly sanitize the 'reason' argument used in RequestHandler.set_status and tornado.web.HTTPError. This argument is intended for custom HTTP status phrases but is reflected unescaped in both the HTTP status line (leading to header injection) and the default HTML error page (leading to reflected XSS). An attacker can exploit this by providing malicious input to an application that reflects user-controlled data into these error-handling functions. The vulnerability is mitigated in version 6.5.3 by escaping the input; developers can also mitigate this by avoiding the use of untrusted data in the 'reason' field or using 'log_message' for internal error details.

Affected products

  • tornadoweb tornado < 6.5.3

Identifiers

  • CVE-2025-67724
  • GHSA-pr2v-jx2c-wg9f
  • PYSEC-2025-265

Timeline

  • 2025-12-11: disclosed: Vulnerability reported and initial advisory published
  • 2025-12-12: advisory: NVD publication date
  • 2026-07-20: advisory: GitHub Advisory reviewed and updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.