Most recent entries from all

BELL-CVE-2025-67724

Affected: Alpaquita:25: py3-tornado, Alpaquita:stream: py3-tornado

BREW-jupyterlab-CVE-2025-67724 — Tornado vulnerable to Header Injection and XSS via reason argument

Affected: Homebrew: jupyterlab

# Header injection and XSS via `reason` argument

## Summary

The `reason` argument (used by both `RequestHandler.set_status` and `tornado.web.HTTPError` is designed to allow applications to pass custom "reason" phrases (the "Not Found" in `HTTP/1.1 404 Not Found`) to the HTTP status line (mainly for non-standard status codes). Vulnerabilities exist in Tornado versions prior to 6.5.3 if untrusted data is passed as the `reason` argument.

## Details

In vulnerable versions, the supplied `reason` phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS).

## Impact

* **Type:** Reflected Cross-Site Scripting (CWE-79) in default error page, or header injection (CWE-644) * **Actors:** Remote attacker who can cause the application to raise `HTTPError`/`set_status` with an attacker-controlled `reason` (e.g., via query parameter used by developer). * **Effect:** Execution of arbitrary JavaScript in victims' browsers when they view the error page — possible session token theft, CSRF escalation, UI spoofing, or other client-side attacks depending on context. * **Scope:** Only applications that explicitly reflect untrusted input into `reason` are affected.

## Mitigation

Aside from upgrading to Tornado 6.5.3 or newer, the vulnerability can be mitigated by not using untrusted data for the `reason` argument. In the intended use case the `reason` argument would generally be a string litera…

certfr-2026-avi-0641 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-0641

EUVD-2026-264069

fkie_cve-2025-67724

Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom "reason" phrases (the "Not Found" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). This issue is fixed in version 6.5.3.

GHSA-pr2v-jx2c-wg9f — Tornado vulnerable to Header Injection and XSS via reason argument

Affected: PyPI: tornado

# Header injection and XSS via `reason` argument

## Summary

## Details

## Impact

## Mitigation

OESA-2026-1903 — python-tornado security update

Affected: openEuler:24.03-LTS-SP3: python-tornado, openEuler:20.03-LTS-SP4: python-tornado, openEuler:22.03-LTS-SP4: python-tornado, openEuler:24.03-LTS: python-tornado, openEuler:24.03-LTS-SP1: python-tornado, openEuler:24.03-LTS-SP2: python-tornado

Tornado is an open source version of the scalable, non-blocking web server and tools. Security Fix(es):

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.(CVE-2026-35536)

openSUSE-SU-2025:15838-1 — python311-tornado6-6.5.4-1.1 on GA media

python311-tornado6-6.5.4-1.1 on GA media

PYSEC-2025-265

Affected: PyPI: tornado

SUSE-EL-9-CLIENT-TOOLS-2026-1026 — Security update 5.0.7 for Multi-Linux Manager Salt Bundle

Security update 5.0.7 for Multi-Linux Manager Salt Bundle

UBUNTU-CVE-2025-67724

Affected: Ubuntu:Pro:16.04:LTS: python-tornado, Ubuntu:Pro:18.04:LTS: python-tornado, Ubuntu:Pro:20.04:LTS: python-tornado, Ubuntu:Pro:22.04:LTS: python-tornado, Ubuntu:24.04:LTS: python-tornado, Ubuntu:25.10: python-tornado

WID-SEC-W-2026-2933 — Splunk SOAR: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Splunk SOAR ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.