Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Tornado on Ubuntu: Malicious Code Injection and Crash Risk
published 10 months ago
Summary
If you're using Tornado on an affected Ubuntu version, an attacker could inject malicious code into your website or overwhelm your server with excessive requests, potentially leading to a denial of service. This issue affects Ubuntu versions 20.04, 22.04, and others. Update your Tornado installation to the latest version to prevent these risks.
What to do
- Update canonical python-tornado to version 4.2.1-1ubuntu3.1+esm2.
- Update canonical python-tornado to version 4.5.3-1ubuntu0.2+esm2.
- Update canonical python-tornado to version 6.0.3+really5.1.1-3ubuntu0.1~esm3.
- Update canonical python-tornado to version 6.1.0-3ubuntu0.1~esm4.
- Update canonical python-tornado to version 6.4.0-1ubuntu0.4.
- Update canonical python-tornado to version 6.4.2-3ubuntu0.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:16.04:LTS | canonical | python-tornado |
< 4.2.1-1ubuntu3.1+esm2 Fix: upgrade to 4.2.1-1ubuntu3.1+esm2
|
| Ubuntu:Pro:18.04:LTS | canonical | python-tornado |
< 4.5.3-1ubuntu0.2+esm2 Fix: upgrade to 4.5.3-1ubuntu0.2+esm2
|
| Ubuntu:Pro:20.04:LTS | canonical | python-tornado |
< 6.0.3+really5.1.1-3ubuntu0.1~esm3 Fix: upgrade to 6.0.3+really5.1.1-3ubuntu0.1~esm3
|
| Ubuntu:Pro:22.04:LTS | canonical | python-tornado |
< 6.1.0-3ubuntu0.1~esm4 Fix: upgrade to 6.1.0-3ubuntu0.1~esm4
|
| Ubuntu:24.04:LTS | canonical | python-tornado |
< 6.4.0-1ubuntu0.4 Fix: upgrade to 6.4.0-1ubuntu0.4
|
| Ubuntu:25.10 | canonical | python-tornado |
< 6.4.2-3ubuntu0.2 Fix: upgrade to 6.4.2-3ubuntu0.2
|
Original advisory text
python-tornado vulnerabilities
It was discovered that Tornado incorrectly handled special characters in
HTTP headers. An attacker could possibly use this issue to execute a cross-
site scripting (XSS) attack. This issue only affected Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10.
(CVE-2025-67724)
It was discovered that Tornado incorrectly handled repeated HTTP headers.
An attacker could possibly use this issue to cause Tornado to use excessive
resources, causing a denial of service. (CVE-2025-67725)
It was discovered that Tornado incorrectly handled parsing of certain HTTP
header values. An attacker could possibly use this issue to cause Tornado
to use excessive resources, causing a denial of service. (CVE-2025-67726)
HTTP headers. An attacker could possibly use this issue to execute a cross-
site scripting (XSS) attack. This issue only affected Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10.
(CVE-2025-67724)
It was discovered that Tornado incorrectly handled repeated HTTP headers.
An attacker could possibly use this issue to cause Tornado to use excessive
resources, causing a denial of service. (CVE-2025-67725)
It was discovered that Tornado incorrectly handled parsing of certain HTTP
header values. An attacker could possibly use this issue to cause Tornado
to use excessive resources, causing a denial of service. (CVE-2025-67726)
References
- https://ubuntu.com/security/notices/USN-7950-1 Vendor Advisory
Timeline
Published8 Jan 2026
Updated24 Apr 2026
First seen24 Apr 2026
Sources
USN-7950-1 · OSV
Track software like this
Free during beta