CVE-2025-67725

CVE-2025-67725 is a Denial of Service (DoS) vulnerability affecting Tornado web framework versions 6.5.2 and below. A maliciously crafted HTTP request with repeated header names can block the server's event loop due to inefficient string concatenation in the HTTPHeaders.add method. This vulnerability has a CVSS score of 7.5 (HIGH), indicating it can be exploited remotely with low attack complexity, leading to a complete loss of availability. While the severity can be high if the max_header_size is increased, it is lower at the default 64KB. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.