Advisories » MGASA-2026-0092

Updated python-tornado packages fix security vulnerabilities

Publication date: 10 Apr 2026
Modification date: 10 Apr 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-67724 , CVE-2025-67725 , CVE-2025-67726

Description

Tornado vulnerable to Header Injection and XSS via reason argument.
(CVE-2025-67724)
Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing.
(CVE-2025-67725)
Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters.
(CVE-2025-67726)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=35326
• https://lists.debian.org/debian-security-announce/2026/msg00104.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67724
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67725
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67726

SRPMS

9/core

• python-tornado-6.3.2-1.3.mga9