CVE-2025-67724
2 advisories.
PyPI/tornado CVE-2025-67724: medium 5.4, EPSS 0.24%
Tornado vulnerable to Header Injection and XSS via reason argument
Action: Upgrade tornado to 6.5.3 or later.
pip install tornado==6.5.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.5.3 | - |
Fixed versions
| 6.5.3 |
Sources
- osv: GHSA-pr2v-jx2c-wg9f
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-pr2v-jx2c-wg9f
- https://nvd.nist.gov/vuln/detail/CVE-2025-67724
- https://github.com/tornadoweb/tornado/commit/9c163aebeaad9e6e7d28bac1f33580eb00b0e421
- https://github.com/pypa/advisory-database/tree/main/vulns/tornado/PYSEC-2025-265.yaml
- https://github.com/tornadoweb/tornado
- https://github.com/tornadoweb/tornado/releases/tag/v6.5.3
CVE-2025-67724 · published · modified · JSON
PyPI/tornado CVE-2025-67724: medium 6.1, EPSS 0.24%
Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header inje
Action: Upgrade tornado to 6.5.3 or later.
pip install tornado==6.5.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.5.3 | - |
Fixed versions
| 6.5.3 |
Sources
- osv: PYSEC-2025-265
- https://github.com/tornadoweb/tornado/releases/tag/v6.5.3
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-pr2v-jx2c-wg9f
- https://github.com/tornadoweb/tornado/commit/9c163aebeaad9e6e7d28bac1f33580eb00b0e421
CVE-2025-67724 · published · modified · JSON