CVE-2025-67724: Tornado vulnerable to Header Injection and XSS via reason argument
The reason argument (used by both RequestHandler.set_status and tornado.web.HTTPError is designed to allow applications to pass custom “reason” phrases (the “Not Found” in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). Vulnerabilities exist in Tornado versions prior to 6.5.3 if untrusted data is passed as the reason argument.
References
- github.com/advisories/GHSA-pr2v-jx2c-wg9f
- github.com/pypa/advisory-database/tree/main/vulns/tornado/PYSEC-2025-265.yaml
- github.com/tornadoweb/tornado/commit/9c163aebeaad9e6e7d28bac1f33580eb00b0e421
- github.com/tornadoweb/tornado/releases/tag/v6.5.3
- github.com/tornadoweb/tornado/security/advisories/GHSA-pr2v-jx2c-wg9f
- nvd.nist.gov/vuln/detail/CVE-2025-67724
Code Behaviors & Features
Detect and mitigate CVE-2025-67724 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →