CVE-2025-67724: Tornado vulnerable to Header Injection and XSS via reason argument
The reason argument (used by both RequestHandler.set_status and tornado.web.HTTPError is designed to allow applications to pass custom “reason” phrases (the “Not Found” in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). Vulnerabilities exist in Tornado versions prior to 6.5.3 if untrusted data is passed as the reason argument.
References
- github.com/advisories/GHSA-pr2v-jx2c-wg9f
- github.com/pypa/advisory-database/tree/main/vulns/tornado/PYSEC-2025-265.yaml
- github.com/tornadoweb/tornado/commit/9c163aebeaad9e6e7d28bac1f33580eb00b0e421
- github.com/tornadoweb/tornado/releases/tag/v6.5.3
- github.com/tornadoweb/tornado/security/advisories/GHSA-pr2v-jx2c-wg9f
- nvd.nist.gov/vuln/detail/CVE-2025-67724
Code Behaviors & Features
Detect and mitigate CVE-2025-67724 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →