CVE-2025-67726

CVE-2025-67726 is a Denial of Service (DoS) vulnerability affecting Tornado web framework versions 6.5.2 and below. An inefficient algorithm in the _parseparam function leads to quadratic CPU usage when parsing maliciously crafted HTTP Content-Disposition headers, potentially rendering the server unresponsive due to Tornado's single event loop architecture. With a CVSS score of 7.5 (HIGH), this vulnerability is easily exploitable over the network with low attack complexity, requiring no user interaction or privileges, and resulting in high availability impact. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.