CVE-2025-67725: Tornado quadratic DoS via repeated header coalescing

Executive brief

Tornado is a Python web framework and asynchronous networking library. A vulnerability in how it handles web request headers allows an attacker to slow down or crash the server by sending a specially crafted request with many repeated headers. This can lead to a denial-of-service (DoS) condition, making the application unavailable to legitimate users.

Technical details

The HTTPHeaders.add method in Tornado's web server implementation uses string concatenation to coalesce values when the same header name is repeated in a request. Because Python strings are immutable, each concatenation requires copying the existing string, leading to O(n²) time complexity relative to the number of repeated headers. Since Tornado operates on a single-threaded event loop, an attacker can exploit this by sending a large number of repeated headers to block the loop for an extended period. The impact is significantly higher if the default 'max_header_size' (64KB) has been increased. This issue is fixed in version 6.5.3.

Affected products

• Tornadoweb Tornado < 6.5.3

Timeline

• 2025-12-11: disclosed
• 2025-12-12: advisory: NVD publication date
• 2026-07-20: patched: GitHub Advisory published/updated date

References

• https://api.github.com/users/Finder16
• https://github.com/Finder16
• https://api.github.com/users/Finder16/gists%7B/gist_id%7D
• https://api.github.com/users/Finder16/repos
• https://avatars.githubusercontent.com/u/101492831?v=4
• https://api.github.com/users/Finder16/events%7B/privacy%7D