python-tornado - Debian Package Tracker

general

source: python-tornado (main)
version: 6.5.4-1
maintainer: Debian Python Team (DMD)
uploaders: Yaroslav Halchenko [DMD] – Julian Taylor [DMD] – Carl Chenet [DMD] – Julien Puydt [DMD]
arch: all any
std-ver: 4.7.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 6.1.0-1
o-o-sec: 6.1.0-1+deb11u3
oldstable: 6.2.0-3+deb12u2
old-sec: 6.2.0-3+deb12u2
stable: 6.4.2-3
testing: 6.5.4-0.1
unstable: 6.5.4-1

versioned links

6.1.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.1.0-1+deb11u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.2.0-3+deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.4.2-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.5.4-0.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.5.4-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

python-tornado-doc
python3-tornado

action needed

debian/patches: 1 patch with invalid metadata, 1 patch to forward upstream high

Among the 8 debian patches available in version 6.5.4-1 of the package, we noticed the following issues:

1 patch with invalid metadata that ought to be fixed.
1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2024-09-25 Last update: 2026-03-06 14:02

3 security issues in trixie high

There are 3 open security issues in trixie.

3 important issues:

CVE-2025-67724: Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom "reason" phrases (the "Not Found" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). This issue is fixed in version 6.5.3.
CVE-2025-67725: Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same header name is repeated, causing a Denial of Service (DoS). Due to Python string immutability, each concatenation copies the entire string, resulting in O(n²) time complexity. The severity can vary from high if max_header_size has been increased from its default, to low if it has its default value of 64KB. This issue is fixed in version 6.5.3.
CVE-2025-67726: Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.

Created: 2025-12-12 Last update: 2026-03-06 09:30

3 security issues in bookworm high

There are 3 open security issues in bookworm.

3 important issues:

CVE-2025-67724: Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom "reason" phrases (the "Not Found" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). This issue is fixed in version 6.5.3.
CVE-2025-67725: Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same header name is repeated, causing a Denial of Service (DoS). Due to Python string immutability, each concatenation copies the entire string, resulting in O(n²) time complexity. The severity can vary from high if max_header_size has been increased from its default, to low if it has its default value of 64KB. This issue is fixed in version 6.5.3.
CVE-2025-67726: Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.

Created: 2025-12-12 Last update: 2026-03-06 09:30

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2026-01-07 Last update: 2026-03-08 08:00

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 87d4259fb20a3aada620b5c27ff72640d0397dee
Author: Carlos Henrique Lima Melara <charlesmelara@riseup.net>
Date:   Sat Mar 7 19:12:47 2026 -0300

    d/p/Make-tests-compatible-with-curl-8.19.0.patch: fix patch headers
    
    I was living in the distant past of 2025 yesterday, took a day to move
    to 2026. Also add the merge request URL to forwarded field.

Created: 2026-03-08 Last update: 2026-03-08 00:00

lintian reports 6 warnings normal

Lintian reports 6 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-03-06 Last update: 2026-03-06 15:00

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.3 instead of 4.7.0).

Created: 2025-02-21 Last update: 2026-03-06 13:02

testing migrations

excuses:
- Migration status for python-tornado (6.5.4-0.1 to 6.5.4-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Autopkgtest for dask.distributed/2024.12.1+ds-1: amd64: Failed (not a regression) ♻ (reference ♻), arm64: Failed (not a regression) ♻ (reference ♻), i386: Failed (not a regression) ♻ (reference ♻), ppc64el: Failed (not a regression) ♻ (reference ♻), riscv64: Test triggered (failure will be ignored), s390x: Failed (not a regression) ♻ (reference ♻)
- ∙ ∙ Autopkgtest for jupyter-server/2.17.0-1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Regression ♻ (reference ♻), s390x: Regression ♻ (reference ♻)
- ∙ ∙ Autopkgtest for python-tornado/6.5.4-1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Too young, only 2 of 5 days old
- Additional info (not blocking):
- ∙ ∙ Updating python-tornado will fix bugs in testing: #1129145
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/p/python-tornado.html
- ∙ ∙ Reproduced on amd64
- ∙ ∙ Reproduced on arm64
- ∙ ∙ Reproduced on armhf
- ∙ ∙ Reproduced on i386
- ∙ ∙ Reproduced on ppc64el
- Not considered

news

[rss feed]

[2026-03-06] Accepted python-tornado 6.5.4-1 (source) into unstable (Carlos Henrique Lima Melara)
[2026-01-31] Accepted python-tornado 6.1.0-1+deb11u3 (source) into oldoldstable-security (Daniel Leidert)
[2026-01-09] python-tornado 6.5.4-0.1 MIGRATED to testing (Debian testing watch)
[2026-01-07] Accepted python-tornado 6.5.4-0.1 (source) into unstable (Adrian Bunk)
[2025-10-09] python-tornado 6.5.2-3 MIGRATED to testing (Debian testing watch)
[2025-10-05] Accepted python-tornado 6.5.2-3 (source) into unstable (Bo YU)
[2025-09-28] Accepted python-tornado 6.5.2-2 (source) into unstable (Thomas Goirand)
[2025-08-26] Accepted python-tornado 6.5.2-1 (source) into experimental (Thomas Goirand)
[2025-06-06] Accepted python-tornado 6.2.0-3+deb12u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Daniel Leidert)
[2025-06-06] Accepted python-tornado 6.2.0-3+deb12u2 (source) into stable-security (Debian FTP Masters) (signed by: Daniel Leidert)
[2025-05-29] Accepted python-tornado 6.1.0-1+deb11u2 (source) into oldstable-security (Daniel Leidert)
[2025-05-25] python-tornado 6.4.2-3 MIGRATED to testing (Debian testing watch)
[2025-05-22] Accepted python-tornado 6.4.2-3 (source) into unstable (Bo YU)
[2025-05-18] Accepted python-tornado 6.4.2-2 (source) into unstable (Colin Watson)
[2025-01-03] Accepted python-tornado 6.2.0-3+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Daniel Leidert)
[2025-01-01] Accepted python-tornado 6.1.0-1+deb11u1 (source) into oldstable-security (Daniel Leidert)
[2024-12-04] python-tornado 6.4.2-1 MIGRATED to testing (Debian testing watch)
[2024-11-29] Accepted python-tornado 6.4.2-1 (source) into unstable (Colin Watson)
[2024-09-30] python-tornado 6.4.1-3 MIGRATED to testing (Debian testing watch)
[2024-09-25] Accepted python-tornado 6.4.1-3 (source) into unstable (Alexandre Detiste)
[2024-08-25] python-tornado 6.4.1-2 MIGRATED to testing (Debian testing watch)
[2024-08-19] Accepted python-tornado 6.4.1-2 (source) into unstable (Colin Watson)
[2024-06-20] python-tornado 6.4.1-1 MIGRATED to testing (Debian testing watch)
[2024-06-20] python-tornado 6.4.1-1 MIGRATED to testing (Debian testing watch)
[2024-06-13] Accepted python-tornado 6.4.1-1 (source) into unstable (Julien Puydt)
[2024-06-03] python-tornado 6.4.0-2 MIGRATED to testing (Debian testing watch)
[2024-05-29] Accepted python-tornado 6.4.0-2 (source) into unstable (Timo Röhling)
[2024-01-24] python-tornado 6.4.0-1 MIGRATED to testing (Debian testing watch)
[2024-01-21] Accepted python-tornado 6.4.0-1 (source) into unstable (Stefano Rivera)
[2023-06-28] python-tornado 6.3.2-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 1

links

homepage
lintian (0, 6)
buildd: logs, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
l10n (-, 100)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 6.5.4-0.1
1 bug