Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐍
🐍 PyPI
Not in CISA KEV
MEDIUM severity

Tornado vulnerable to Header Injection and XSS via reason argumentGHSA-pr2v-jx2c-wg9f

MEDIUMFix: tornadoweb/tornado@9c163ae

GHSA-pr2v-jx2c-wg9f is a medium-severity (CVSS 5.4) Cross-site Scripting (XSS) vulnerability in tornado. A fix is available for tornado — see the affected versions and patch details below.

Also known asCVE-2025-67724PYSEC-2025-265
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 22, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
0.2%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs14th percentile — riskier than 14% of all scored CVEsHighest risk
0.00%0.25%0.49%0.74%0.1%0.2%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-pr2v-jx2c-wg9f by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 395,249 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected
🐍tornado

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Header injection and XSS via reason argument

Summary

The reason argument (used by both RequestHandler.set_status and tornado.web.HTTPError is designed to allow applications to pass custom "reason" phrases (the "Not Found" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). Vulnerabilities exist in Tornado versions prior to 6.5.3 if untrusted data is passed as the reason argument.

Details

In vulnerable versions, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS).

Impact

  • Type: Reflected Cross-Site Scripting (CWE-79) in default error page, or header injection (CWE-644)
  • Actors: Remote attacker who can cause the application to raise HTTPError/set_status with an attacker-controlled reason (e.g., via query parameter used by developer).
  • Effect: Execution of arbitrary JavaScript in victims' browsers when they view the error page — possible session token theft, CSRF escalation, UI spoofing, or other client-side attacks depending on context.
  • Scope: Only applications that explicitly reflect untrusted input into reason are affected.

Mitigation

Aside from upgrading to Tornado 6.5.3 or newer, the vulnerability can be mitigated by not using untrusted data for the reason argument. In the intended use case the reason argument would generally be a string literal and not derived from user input. Also, the reason argument is rarely required (reason phrases are not used at all in HTTP/2) and can generally be omitted.

For a general-purpose error message in HTTPError, consider using the log_message argument instead of reason.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPItornadoall versions6.5.3pip install --upgrade 'tornado==6.5.3'

Affected Products

1 product · 1 configurations
Application
tornadotornadoweb
< 6.5.3
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for tornado, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update tornado to 6.5.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-pr2v-jx2c-wg9f is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate
Workaround published by Red Hat
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Source: Red Hat security advisory for GHSA-pr2v-jx2c-wg9f (CC BY 4.0)

Frequently Asked Questions

# Header injection and XSS via `reason` argument ## Summary The `reason` argument (used by both `RequestHandler.set_status` and `tornado.web.HTTPError` is designed to allow applications to pass custom "reason" phrases (the "Not Found" in `HTTP/1.1 404 Not Found`) to the HTTP status line (mainly for non-standard status codes). Vulnerabilities exist in Tornado versions prior to 6.5.3 if untrusted data is passed as the `reason` argument. ## Details In vulnerable versions, the supplied `reason` phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in
O3 Security · Impact-Aware SCA

Is GHSA-pr2v-jx2c-wg9f in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
Tornado vulnerable to Header Injection and XSS via…