USN-7950-1: Tornado vulnerabilities
It was discovered that Tornado incorrectly handled special characters in HTTP headers. An attacker could possibly use this issue to execute a cross- site scripting (XSS) attack. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-67724) It was discovered that Tornado incorrectly handled repeated HTTP headers. An attacker could possibly use this issue to cause Tornado to use excessive resources, causing a denial of service. (CVE-2025-67725) It was discovered that Tornado incorrectly handled parsing of certain HTTP header values. An attacker could possibly use this issue to cause Tornado to use excessive resources, causing a denial of service. (CVE-2025-67726)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/python3-tornadoto a version that resolves this vulnerability.Fixed in 6.4.2-3ubuntu0.2 - Upgrade
Upgrade
ubuntu/python3-tornadoto a version that resolves this vulnerability.Fixed in 6.4.2-1ubuntu0.25.04.3 - Upgrade
Upgrade
ubuntu/python3-tornadoto a version that resolves this vulnerability.Fixed in 6.4.0-1ubuntu0.4 - Upgrade
Upgrade
ubuntu/python3-tornadoto a version that resolves this vulnerability.Fixed in Ubuntu Pro - Upgrade
Upgrade
ubuntu/python-tornadoto a version that resolves this vulnerability.Fixed in Ubuntu Pro
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which Ubuntu releases are affected by the cross-site scripting issue?
The XSS issue, CVE-2025-67724, only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10.
What kinds of HTTP requests could be used to trigger the denial-of-service issues?
CVE-2025-67725 involves repeated HTTP headers, while CVE-2025-67726 involves certain HTTP header values. Both may allow an attacker to make Tornado consume excessive resources and cause denial of service.
What is required for exploitation?
The reported attack vectors are crafted HTTP headers. The available information does not state that an attacker needs prior authentication or local access.