Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-67724

24
FAUCET Score

CVE-2025-67724 is a vulnerability in the Tornado Python web framework (versions 6.5.2 and below) that allows for HTTP header injection or Cross-Site Scripting (XSS) due to unescaped reason phrases in HTTP headers or default error pages. This medium-severity vulnerability (CVSS 6.1) can be exploited remotely with low attack complexity, potentially leading to information disclosure and integrity impacts. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
< 6.5.3CPE matchmatch criteria
cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

5.4MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
Exploitability Score
2.8
Impact Score
2.5
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.20%
Probability of exploitation in next 30 days
EPSS Percentile
10.5%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0020 is in the 10th percentile among its peer group of 26,221 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (69)

github_advisorypatch availablevia nvd_reference
View patch
pippatch availablevia ghsa
Product: tornadoFixed in: 6.5.3
redhatvendor investigatingvia redhat_api
Product: External Secrets Operator for Red Hat OpenShiftFixed in: external-secrets-operator/external-secrets-operator-bundle
redhatvendor investigatingvia redhat_api
Product: External Secrets Operator for Red Hat OpenShiftFixed in: external-secrets-operator/external-secrets-operator-rhel9
redhatvendor investigatingvia redhat_api
Product: External Secrets Operator for Red Hat OpenShiftFixed in: external-secrets-operator/external-secrets-rhel9
redhatvendor investigatingvia redhat_api
Product: external secrets operator for Red Hat OpenShift - Tech PreviewFixed in: external-secrets-operator/bitwarden-sdk-server-rhel9
redhatvendor investigatingvia redhat_api
Product: external secrets operator for Red Hat OpenShift - Tech PreviewFixed in: external-secrets-operator/external-secrets-operator-bundle
redhatvendor investigatingvia redhat_api
Product: external secrets operator for Red Hat OpenShift - Tech PreviewFixed in: external-secrets-operator/external-secrets-operator-rhel9
redhatvendor investigatingvia redhat_api
Product: external secrets operator for Red Hat OpenShift - Tech PreviewFixed in: external-secrets-operator/external-secrets-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 2Fixed in: openshift-service-mesh/grafana-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 2Fixed in: openshift-service-mesh/istio-cni-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 2Fixed in: openshift-service-mesh/istio-must-gather-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 2Fixed in: openshift-service-mesh/istio-operator-bundle
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 2Fixed in: openshift-service-mesh/istio-rhel8-operator
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 2Fixed in: openshift-service-mesh/pilot-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 2Fixed in: openshift-service-mesh/proxyv2-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 2Fixed in: openshift-service-mesh/ratelimit-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-cni-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-must-gather-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-pilot-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-proxyv2-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-rhel9-operator
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-sail-operator-bundle
redhatvendor investigatingvia redhat_api
Product: Red Hat Advanced Cluster Security 4Fixed in: advanced-cluster-security/rhacs-collector-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: rhel10/keylime-registrar
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: rhel10/keylime-verifier
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: rhel9/keylime-registrar
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: rhel9/keylime-verifier
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux AI (RHEL AI) 3Fixed in: rhelai3/bootc-cuda-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux AI (RHEL AI) 3Fixed in: rhelai3/disk-image-cuda-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-llama-stack-core-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-trustyai-ragas-lls-provider-dsp-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: python-pep517
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenStack Platform 16.2Fixed in: rhosp-rhel8/openstack-cinder-backup
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenStack Platform 16.2Fixed in: rhosp-rhel8/openstack-cinder-volume
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenStack Platform 16.2Fixed in: rhosp-rhel8/openstack-haproxy
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenStack Platform 16.2Fixed in: rhosp-rhel8/openstack-manila-share
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenStack Platform 16.2Fixed in: rhosp-rhel8/openstack-mariadb
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenStack Platform 16.2Fixed in: rhosp-rhel8/openstack-ovn-northd
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenStack Platform 16.2Fixed in: rhosp-rhel8/openstack-rabbitmq
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenStack Platform 16.2Fixed in: rhosp-rhel8/openstack-redis
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenStack Platform 17.1Fixed in: rhosp-rhel9/openstack-cinder-volume
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenStack Platform 17.1Fixed in: rhosp-rhel9/openstack-haproxy
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenStack Platform 17.1Fixed in: rhosp-rhel9/openstack-manila-share
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenStack Platform 17.1Fixed in: rhosp-rhel9/openstack-mariadb
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenStack Platform 17.1Fixed in: rhosp-rhel9/openstack-ovn-northd
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenStack Platform 17.1Fixed in: rhosp-rhel9/openstack-rabbitmq
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenStack Platform 17.1Fixed in: rhosp-rhel9/openstack-redis
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenStack Platform 17.1Fixed in: rhosp-rhel9/openstack-cinder-backup
redhatvendor investigatingvia redhat_api
Product: External Secrets Operator for Red Hat OpenShiftFixed in: external-secrets-operator/bitwarden-sdk-server-rhel9

Vendor Advisories (2)

pipGHSA-pr2v-jx2c-wg9fmedium

Tornado vulnerable to Header Injection and XSS via reason argument

Jul 20, 2026
redhatCVE-2025-67724Moderate

tornado: Tornado Header Injection and XSS via reason argument

Dec 12, 2025

References

github.com / tornadoweb/tornado/commit/9c163aebeaad9e6e7d28bac1f33580eb00b0e421
Patch
github.com / tornadoweb/tornado/releases/tag/v6.5.3
Release Notes
github.com / tornadoweb/tornado/security/advisories/GHSA-pr2v-jx2c-wg9f
MitigationVendor Advisory