What is the CVSS score of CVE-2025-67725?

CVE-2025-67725 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2025-67725?

Yes, a patch is available for CVE-2025-67725. Update the affected software to the latest version immediately.

py3-tornado CVE-2025-67725

EUVD-2025-203031 HIGH

N/A vendor:alpine

GHSA-c98p-7wgm-6p64 PYSEC-2025-266

Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:35 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on tornado (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 6.5.3.

DescriptionCVE.org

Alpine Linux: py3-tornado fixed in 6.5.4-r0

AnalysisAI

Tornado Python web framework on Alpine Linux received a security fix in package version 6.5.4-r0, addressing an uncharacterized vulnerability. The nature of the flaw, affected attack surface, and exploitability conditions are not disclosed in available intelligence - only the patched Alpine package version is confirmed. EPSS scoring places exploitation probability at 0.21% (44th percentile), suggesting low-to-moderate automated exploitation likelihood at time of analysis, with no public exploit identified at time of analysis.

Technical ContextAI

Tornado is an asynchronous Python web framework and networking library widely used in high-concurrency applications. The Alpine Linux package py3-tornado wraps the upstream Tornado project for Alpine's apk package ecosystem. The Alpine package version 6.5.4-r0 indicates the upstream Tornado version fixed is 6.5.4 with Alpine revision 0. No CWE root cause class, CPE strings, or vulnerability class details are available in the provided intelligence data - the specific subsystem (HTTP server, WebSocket, auth module, template engine, etc.) implicated by this fix is unknown.

RemediationAI

Upgrade the py3-tornado Alpine Linux package to version 6.5.4-r0 or later using 'apk upgrade py3-tornado' on affected Alpine Linux systems - this is the vendor-released patch confirmed by the Alpine Linux security team. Because the nature of the vulnerability is undisclosed, specific workarounds cannot be recommended with confidence. As a general compensating control pending upgrade, consider restricting network exposure of any Tornado-based services to trusted network segments only, acknowledging this does not eliminate risk if the vulnerability is exploitable from an authenticated or internal position. Monitor the Alpine Linux security advisories and the upstream Tornado changelog at the Tornado GitHub repository for additional disclosure. No advisory URL was included in the provided reference data to cite directly.