{"id":"CVE-2025-67724","title":"tornado: Tornado Header Injection and XSS via reason argument (CVE-2025-67724)","summary":"An unescaped input flaw has been discovered in the Tornado networking library. In Tornado, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (whe…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvssSource":"vendor","cwe":"CWE-79","vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["external_secrets_operator_for_red_hat_openshift","external_secrets_operator_for_red_hat_openshift_tech_preview","openshift_service_mesh 2","openshift_service_mesh 3","advanced_cluster_security 4","enterprise_linux 10","enterprise_linux 9","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","openshift_container_platform 4","openstack_platform 16.2","openstack_platform 17.1"],"patched":["tornado 6.5.3"],"published":"2025-12-12","updated":"2026-09-23","sourceUpdated":"2026-09-23T04:22:39+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67724.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67724.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-67724"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2421719"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-67724"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67724"},{"url":"https://github.com/tornadoweb/tornado/commit/9c163aebeaad9e6e7d28bac1f33580eb00b0e421"},{"url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.3"},{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-pr2v-jx2c-wg9f"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.0024,"epssPercentile":0.15402,"aliases":["PYSEC-2025-265","GHSA-pr2v-jx2c-wg9f"],"ecosystem":"pip","scores":{"vendor":5.4,"osv":6.1},"ingestedAt":"2026-07-13T18:58:06.906Z","slug":"CVE-2025-67724","body":"## Overview\n\nAn unescaped input flaw has been discovered in the Tornado networking library. In Tornado, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom \"reason\" phrases (the \"Not Found\" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes).\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: External Secrets Operator for Red Hat OpenShift, external secrets operator for Red Hat OpenShift - Tech Preview, OpenShift Service Mesh 2, OpenShift Service Mesh 3, Red Hat Advanced Cluster Security 4, Red Hat Enterprise Linux 10, … · no fix planned: External Secrets Operator for Red Hat OpenShift, external secrets operator for Red Hat OpenShift - Tech Preview, OpenShift Service Mesh 2, OpenShift Service Mesh 3, … · updated 2026-09-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67724.json)\n\n**tornado: Tornado Header Injection and XSS via reason argument** — rated Moderate by Red Hat. Released 2025-12-12, updated 2026-09-23.\n\nAffected:\n\n- External Secrets Operator for Red Hat OpenShift\n- external secrets operator for Red Hat OpenShift - Tech Preview\n- OpenShift Service Mesh 2\n- OpenShift Service Mesh 3\n- Red Hat Advanced Cluster Security 4\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenStack Platform 16.2\n- Red Hat OpenStack Platform 17.1\n\nNo fix planned:\n\n- External Secrets Operator for Red Hat OpenShift\n- external secrets operator for Red Hat OpenShift - Tech Preview\n- OpenShift Service Mesh 2\n- OpenShift Service Mesh 3\n- Red Hat Advanced Cluster Security 4\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenStack Platform 16.2\n- Red Hat OpenStack Platform 17.1\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\n## Package advisory (CVE-2025-67724)\n\nAffected packages:\n\n- `tornado < 6.5.3`\n\nPatched in:\n\n- `tornado 6.5.3`\n\nSource: https://osv.dev/vulnerability/PYSEC-2025-265","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":209499,"id":"CVE-2025-67724","ts":1790149052228,"field":"cvss","old":"6.1","new":"5.4"}]}