Bug 2421719 (CVE-2025-67724) - CVE-2025-67724 tornado: Tornado Header Injection and XSS via reason argument
Summary: CVE-2025-67724 tornado: Tornado Header Injection and XSS via reason argument
Keywords:
Status: NEW
Alias: CVE-2025-67724
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2421925 2421926 2421927 2421928
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-12-12 10:18 UTC by OSIDB Bzimport
Modified: 2025-12-12 22:17 UTC (History)
11 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-12-12 10:18:58 UTC 
Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom "reason" phrases (the "Not Found" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). This issue is fixed in version 6.5.3.
Note You need to log in before you can comment on or make changes to this bug.