Security update for python-tornado6
This update for python-tornado6 fixes the following issues: - CVE-2025-67724: unescaped `reason` argument used in HTTP headers and in HTML default error pages can be used by attackers to launch header injection or XSS attacks (bsc#1254903). - CVE-2025-67725: quadratic complexity of string concatenation operations used by the `HTTPHeaders.add` method can lead to DoS when processing a maliciously crafted HTTP request (bsc#1254905). - CVE-2025-67726: quadratic complexity algorithm used in the `_parseparam` function of `httputil.py` can lead to DoS when processing maliciously crafted parameters in a `Content-Disposition` header (bsc#1254904).
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for python-tornado6 fixes the following issues: - CVE-2025-67724: unescaped `reason` argument used in HTTP headers and in HTML default error pages can be used by attackers to launch header injection or XSS attacks (bsc#1254903). - CVE-2025-67725: quadratic complexity of string concatenation operations used by the `HTTPHeaders.add` method can lead to DoS when processing a maliciously crafted HTTP request (bsc#1254905). - CVE-2025-67726: quadratic complexity algorithm used in the `_parseparam` function of `httputil.py` can lead to DoS when processing maliciously crafted parameters in a `Content-Disposition` header (bsc#1254904).
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1254903
- https://bugzilla.suse.com/1254904
- https://bugzilla.suse.com/1254905
- https://www.suse.com/security/cve/CVE-2025-67724
- https://www.suse.com/security/cve/CVE-2025-67725
- https://www.suse.com/security/cve/CVE-2025-67726
- https://www.suse.com/support/update/announcement/2026/suse-su-202620007-1/