OESA-2026-1130

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-1130

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-1130.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2026-1130

Upstream

CVE-2025-67725

Published

2026-01-16T11:59:52Z

Modified

2026-01-16T12:30:16.434028Z

Summary

python-tornado security update

Details

Tornado is an open source version of the scalable, non-blocking web server and tools.

Security Fix(es):

Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same header name is repeated, causing a Denial of Service (DoS). Due to Python string immutability, each concatenation copies the entire string, resulting in O(n²) time complexity. The severity can vary from high if maxheadersize has been increased from its default, to low if it has its default value of 64KB. This issue is fixed in version 6.5.3.(CVE-2025-67725)

Database specific

{
    "severity": "High"
}

References

Affected packages

openEuler:20.03-LTS-SP4

python-tornado

Package

Name: python-tornado
Purl: pkg:rpm/openEuler/python-tornado&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.0.2-11.oe2003sp4

Ecosystem specific

{
    "aarch64": [
        "python-tornado-debuginfo-5.0.2-11.oe2003sp4.aarch64.rpm",
        "python-tornado-debugsource-5.0.2-11.oe2003sp4.aarch64.rpm",
        "python2-tornado-5.0.2-11.oe2003sp4.aarch64.rpm",
        "python3-tornado-5.0.2-11.oe2003sp4.aarch64.rpm"
    ],
    "x86_64": [
        "python-tornado-debuginfo-5.0.2-11.oe2003sp4.x86_64.rpm",
        "python-tornado-debugsource-5.0.2-11.oe2003sp4.x86_64.rpm",
        "python2-tornado-5.0.2-11.oe2003sp4.x86_64.rpm",
        "python3-tornado-5.0.2-11.oe2003sp4.x86_64.rpm"
    ],
    "src": [
        "python-tornado-5.0.2-11.oe2003sp4.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-1130.json"

openEuler:22.03-LTS-SP3

python-tornado

Package

Name: python-tornado
Purl: pkg:rpm/openEuler/python-tornado&distro=openEuler-22.03-LTS-SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.1-5.oe2203sp3

Ecosystem specific

{
    "aarch64": [
        "python-tornado-debuginfo-6.1-5.oe2203sp3.aarch64.rpm",
        "python-tornado-debugsource-6.1-5.oe2203sp3.aarch64.rpm",
        "python-tornado-help-6.1-5.oe2203sp3.aarch64.rpm",
        "python3-tornado-6.1-5.oe2203sp3.aarch64.rpm"
    ],
    "x86_64": [
        "python-tornado-debuginfo-6.1-5.oe2203sp3.x86_64.rpm",
        "python-tornado-debugsource-6.1-5.oe2203sp3.x86_64.rpm",
        "python-tornado-help-6.1-5.oe2203sp3.x86_64.rpm",
        "python3-tornado-6.1-5.oe2203sp3.x86_64.rpm"
    ],
    "src": [
        "python-tornado-6.1-5.oe2203sp3.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-1130.json"

openEuler:22.03-LTS-SP4

python-tornado

Package

Name: python-tornado
Purl: pkg:rpm/openEuler/python-tornado&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.1-5.oe2203sp4

Ecosystem specific

{
    "aarch64": [
        "python-tornado-debuginfo-6.1-5.oe2203sp4.aarch64.rpm",
        "python-tornado-debugsource-6.1-5.oe2203sp4.aarch64.rpm",
        "python-tornado-help-6.1-5.oe2203sp4.aarch64.rpm",
        "python3-tornado-6.1-5.oe2203sp4.aarch64.rpm"
    ],
    "x86_64": [
        "python-tornado-debuginfo-6.1-5.oe2203sp4.x86_64.rpm",
        "python-tornado-debugsource-6.1-5.oe2203sp4.x86_64.rpm",
        "python-tornado-help-6.1-5.oe2203sp4.x86_64.rpm",
        "python3-tornado-6.1-5.oe2203sp4.x86_64.rpm"
    ],
    "src": [
        "python-tornado-6.1-5.oe2203sp4.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-1130.json"

openEuler:24.03-LTS

python-tornado

Package

Name: python-tornado
Purl: pkg:rpm/openEuler/python-tornado&distro=openEuler-24.03-LTS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.5-2.oe2403

Ecosystem specific

{
    "aarch64": [
        "python-tornado-debuginfo-6.5-2.oe2403sp1.aarch64.rpm",
        "python-tornado-debugsource-6.5-2.oe2403sp1.aarch64.rpm",
        "python-tornado-help-6.5-2.oe2403sp1.aarch64.rpm",
        "python3-tornado-6.5-2.oe2403sp1.aarch64.rpm",
        "python-tornado-debuginfo-6.5-2.oe2403sp2.aarch64.rpm",
        "python-tornado-debugsource-6.5-2.oe2403sp2.aarch64.rpm",
        "python-tornado-help-6.5-2.oe2403sp2.aarch64.rpm",
        "python3-tornado-6.5-2.oe2403sp2.aarch64.rpm",
        "python-tornado-debuginfo-6.5-2.oe2403sp3.aarch64.rpm",
        "python-tornado-debugsource-6.5-2.oe2403sp3.aarch64.rpm",
        "python-tornado-help-6.5-2.oe2403sp3.aarch64.rpm",
        "python3-tornado-6.5-2.oe2403sp3.aarch64.rpm",
        "python-tornado-debuginfo-6.5-2.oe2403.aarch64.rpm",
        "python-tornado-debugsource-6.5-2.oe2403.aarch64.rpm",
        "python-tornado-help-6.5-2.oe2403.aarch64.rpm",
        "python3-tornado-6.5-2.oe2403.aarch64.rpm"
    ],
    "x86_64": [
        "python-tornado-debuginfo-6.5-2.oe2403sp1.x86_64.rpm",
        "python-tornado-debugsource-6.5-2.oe2403sp1.x86_64.rpm",
        "python-tornado-help-6.5-2.oe2403sp1.x86_64.rpm",
        "python3-tornado-6.5-2.oe2403sp1.x86_64.rpm",
        "python-tornado-debuginfo-6.5-2.oe2403sp2.x86_64.rpm",
        "python-tornado-debugsource-6.5-2.oe2403sp2.x86_64.rpm",
        "python-tornado-help-6.5-2.oe2403sp2.x86_64.rpm",
        "python3-tornado-6.5-2.oe2403sp2.x86_64.rpm",
        "python-tornado-debuginfo-6.5-2.oe2403sp3.x86_64.rpm",
        "python-tornado-debugsource-6.5-2.oe2403sp3.x86_64.rpm",
        "python-tornado-help-6.5-2.oe2403sp3.x86_64.rpm",
        "python3-tornado-6.5-2.oe2403sp3.x86_64.rpm",
        "python-tornado-debuginfo-6.5-2.oe2403.x86_64.rpm",
        "python-tornado-debugsource-6.5-2.oe2403.x86_64.rpm",
        "python-tornado-help-6.5-2.oe2403.x86_64.rpm",
        "python3-tornado-6.5-2.oe2403.x86_64.rpm"
    ],
    "src": [
        "python-tornado-6.5-2.oe2403sp1.src.rpm",
        "python-tornado-6.5-2.oe2403sp2.src.rpm",
        "python-tornado-6.5-2.oe2403sp3.src.rpm",
        "python-tornado-6.5-2.oe2403.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-1130.json"

openEuler:24.03-LTS-SP1

python-tornado

Package

Name: python-tornado
Purl: pkg:rpm/openEuler/python-tornado&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.5-2.oe2403sp1

Ecosystem specific

{
    "aarch64": [
        "python-tornado-debuginfo-6.5-2.oe2403sp1.aarch64.rpm",
        "python-tornado-debugsource-6.5-2.oe2403sp1.aarch64.rpm",
        "python-tornado-help-6.5-2.oe2403sp1.aarch64.rpm",
        "python3-tornado-6.5-2.oe2403sp1.aarch64.rpm"
    ],
    "x86_64": [
        "python-tornado-debuginfo-6.5-2.oe2403sp1.x86_64.rpm",
        "python-tornado-debugsource-6.5-2.oe2403sp1.x86_64.rpm",
        "python-tornado-help-6.5-2.oe2403sp1.x86_64.rpm",
        "python3-tornado-6.5-2.oe2403sp1.x86_64.rpm"
    ],
    "src": [
        "python-tornado-6.5-2.oe2403sp1.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-1130.json"

openEuler:24.03-LTS-SP2

python-tornado

Package

Name: python-tornado
Purl: pkg:rpm/openEuler/python-tornado&distro=openEuler-24.03-LTS-SP2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.5-2.oe2403sp2

Ecosystem specific

{
    "aarch64": [
        "python-tornado-debuginfo-6.5-2.oe2403sp2.aarch64.rpm",
        "python-tornado-debugsource-6.5-2.oe2403sp2.aarch64.rpm",
        "python-tornado-help-6.5-2.oe2403sp2.aarch64.rpm",
        "python3-tornado-6.5-2.oe2403sp2.aarch64.rpm"
    ],
    "x86_64": [
        "python-tornado-debuginfo-6.5-2.oe2403sp2.x86_64.rpm",
        "python-tornado-debugsource-6.5-2.oe2403sp2.x86_64.rpm",
        "python-tornado-help-6.5-2.oe2403sp2.x86_64.rpm",
        "python3-tornado-6.5-2.oe2403sp2.x86_64.rpm"
    ],
    "src": [
        "python-tornado-6.5-2.oe2403sp2.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-1130.json"

openEuler:24.03-LTS-SP3

python-tornado

Package

Name: python-tornado
Purl: pkg:rpm/openEuler/python-tornado&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.5-2.oe2403sp3

Ecosystem specific

{
    "aarch64": [
        "python-tornado-debuginfo-6.5-2.oe2403sp3.aarch64.rpm",
        "python-tornado-debugsource-6.5-2.oe2403sp3.aarch64.rpm",
        "python-tornado-help-6.5-2.oe2403sp3.aarch64.rpm",
        "python3-tornado-6.5-2.oe2403sp3.aarch64.rpm"
    ],
    "x86_64": [
        "python-tornado-debuginfo-6.5-2.oe2403sp3.x86_64.rpm",
        "python-tornado-debugsource-6.5-2.oe2403sp3.x86_64.rpm",
        "python-tornado-help-6.5-2.oe2403sp3.x86_64.rpm",
        "python3-tornado-6.5-2.oe2403sp3.x86_64.rpm"
    ],
    "src": [
        "python-tornado-6.5-2.oe2403sp3.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-1130.json"