Alerts This Week
Warning Icon 1 717
Alerts This Week
Warning Icon 1 717

Debian Tornado Critical Denial of Service Header Injection DSA-6195-1

debian
Calendar Grey April 3, 2026
Debian Logo
Discover security issues in Tornado, a Python web framework, and fixed versions for Debian distributions.
Multiple security vulnerabilities were discovered in the Tornado Python web framework, which could result in denial of service, header injection or cross-site scripting
Topics%20covered

Topics Covered

security advisory denial of service critical debian cross site scripting header injection

Summary

For the oldstable distribution (bookworm), this problem has been fixed
in version 6.2.0-3+deb12u4.

For the stable distribution (trixie), this problem has been fixed in
version 6.4.2-3+deb13u2.

We recommend that you upgrade your python-tornado packages.

For the detailed security status of python-tornado please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/python-tornado

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/



Severity
critical
Lowest
Low
Medium
High
Critical

Package: python-tornado
CVE ID: CVE-2025-67724 CVE-2025-67725 CVE-2025-67726

Topics%20covered

Topics Covered

security advisory denial of service critical debian cross site scripting header injection

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here