Most recent entries from all

ALSA-2026:0930 — Moderate: pcs security update

Affected: AlmaLinux:8: pcs, AlmaLinux:8: pcs-snmp

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

* tornado: Tornado Quadratic DoS via Repeated Header Coalescing (CVE-2025-67725) * tornado: Tornado Quadratic DoS via Crafted Multipart Parameters (CVE-2025-67726)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-02928

BELL-CVE-2025-67726

Affected: Alpaquita:25: py3-tornado, Alpaquita:stream: py3-tornado

BREW-jupyterlab-CVE-2025-67726 — Tornado: Quadratic DoS via Crafted Multipart Parameters

Affected: Homebrew: jupyterlab

## Summary

The `_parseparam` function in Tornado's `httputil.py` is used to parse specific HTTP header values, such as those in `multipart/form-data`. This function uses an inefficient algorithm that repeatedly calls `string.count()` within a nested loop while processing quoted semicolons (e.g., `param=";"`).

As a result, if an attacker sends a request with a large number of maliciously crafted parameters in a `Content-Disposition` header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period, leading to a Denial of Service (DoS).

**Severity: High**

certfr-2026-avi-0641 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-0641

EUVD-2026-264056

fkie_cve-2025-67726

Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.

GHSA-jhmp-mqwm-3gq8 — Tornado: Quadratic DoS via Crafted Multipart Parameters

Affected: PyPI: tornado

## Summary

**Severity: High**

OESA-2025-2881 — python-tornado security update

Affected: openEuler:24.03-LTS-SP1: python-tornado, openEuler:24.03-LTS-SP2: python-tornado, openEuler:20.03-LTS-SP4: python-tornado, openEuler:22.03-LTS-SP3: python-tornado, openEuler:22.03-LTS-SP4: python-tornado, openEuler:24.03-LTS: python-tornado

Tornado is an open source version of the scalable, non-blocking web server and tools. Security Fix(es):

openSUSE-SU-2025:15838-1 — python311-tornado6-6.5.4-1.1 on GA media

python311-tornado6-6.5.4-1.1 on GA media

PYSEC-2025-267

Affected: PyPI: tornado

RHSA-2026:2106 — Red Hat Security Advisory: RHOAI 2.25.2 - Red Hat OpenShift AI

llama-stack-k8s-operator: Llama Stack service exposed across namespaces due to missing NetworkPolicy node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects fonttools: fontTools: Arbitrary file write leading to remote code execution via malicious .designspace file urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion urllib3: urllib3 Streaming API improperly handles highly compressed data github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token github.com/argoproj/argo-workflows: argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links tornado: Tornado Quadratic DoS via Repeated Header Coalescing tornado: Tornado Quadratic DoS via Crafted Multipart Parameters github.com/expr-lang/expr: Expr: Denial of Service via uncontrolled recursion in expression evaluation github.com/kedacore/keda: KEDA: Arbitrary file read vulnerability in Vault authentication aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking

SUSE-EL-9-CLIENT-TOOLS-2026-1026 — Security update 5.0.7 for Multi-Linux Manager Salt Bundle

Security update 5.0.7 for Multi-Linux Manager Salt Bundle

UBUNTU-CVE-2025-67726

Affected: Ubuntu:Pro:16.04:LTS: python-tornado, Ubuntu:Pro:18.04:LTS: python-tornado, Ubuntu:Pro:20.04:LTS: python-tornado, Ubuntu:Pro:22.04:LTS: python-tornado, Ubuntu:24.04:LTS: python-tornado, Ubuntu:25.10: python-tornado

WID-SEC-W-2026-0195 — Red Hat Enterprise Linux (pcs / tornado): Mehrere Schwachstellen ermöglichen Denial of Service

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux in pcs bezüglich der tornado Komponente ausnutzen, um einen Denial of Service Angriff durchzuführen.