---
id: CVE-2025-67724
title: 'tornado: Tornado Header Injection and XSS via reason argument (CVE-2025-67724)'
summary: >-
  An unescaped input flaw has been discovered in the Tornado networking library.
  In Tornado, the supplied reason phrase is used unescaped in HTTP headers
  (where it could be used for header injection) or in HTML in the default error
  page (whe…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'
cvssSource: vendor
cwe: CWE-79
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
affected:
  - external_secrets_operator_for_red_hat_openshift
  - external_secrets_operator_for_red_hat_openshift_tech_preview
  - openshift_service_mesh 2
  - openshift_service_mesh 3
  - advanced_cluster_security 4
  - enterprise_linux 10
  - enterprise_linux 9
  - enterprise_linux_ai_rhel_ai 3
  - openshift_ai_rhoai
  - openshift_container_platform 4
  - openstack_platform 16.2
  - openstack_platform 17.1
patched:
  - tornado 6.5.3
published: '2025-12-12'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T04:22:39+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67724.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67724.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-67724'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2421719'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-67724'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-67724'
  - url: >-
      https://github.com/tornadoweb/tornado/commit/9c163aebeaad9e6e7d28bac1f33580eb00b0e421
  - url: 'https://github.com/tornadoweb/tornado/releases/tag/v6.5.3'
  - url: >-
      https://github.com/tornadoweb/tornado/security/advisories/GHSA-pr2v-jx2c-wg9f
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.0024
epssPercentile: 0.13574
aliases:
  - PYSEC-2025-265
  - GHSA-pr2v-jx2c-wg9f
ecosystem: pip
scores:
  vendor: 5.4
  osv: 6.1
ingestedAt: '2026-07-13T18:58:06.906Z'
---

## Overview

An unescaped input flaw has been discovered in the Tornado networking library. In Tornado, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom "reason" phrases (the "Not Found" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes).

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: External Secrets Operator for Red Hat OpenShift, external secrets operator for Red Hat OpenShift - Tech Preview, OpenShift Service Mesh 2, OpenShift Service Mesh 3, Red Hat Advanced Cluster Security 4, Red Hat Enterprise Linux 10, … · no fix planned: External Secrets Operator for Red Hat OpenShift, external secrets operator for Red Hat OpenShift - Tech Preview, OpenShift Service Mesh 2, OpenShift Service Mesh 3, … · updated 2026-09-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67724.json)

**tornado: Tornado Header Injection and XSS via reason argument** — rated Moderate by Red Hat. Released 2025-12-12, updated 2026-09-23.

Affected:

- External Secrets Operator for Red Hat OpenShift
- external secrets operator for Red Hat OpenShift - Tech Preview
- OpenShift Service Mesh 2
- OpenShift Service Mesh 3
- Red Hat Advanced Cluster Security 4
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1

No fix planned:

- External Secrets Operator for Red Hat OpenShift
- external secrets operator for Red Hat OpenShift - Tech Preview
- OpenShift Service Mesh 2
- OpenShift Service Mesh 3
- Red Hat Advanced Cluster Security 4
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1

## Remediation

Fix deferred

Workarounds / mitigations:

- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

## Package advisory (CVE-2025-67724)

Affected packages:

- `tornado < 6.5.3`

Patched in:

- `tornado 6.5.3`

Source: https://osv.dev/vulnerability/PYSEC-2025-265