What is the CVSS score of EUVD-2025-203029?

EUVD-2025-203029 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for EUVD-2025-203029?

Yes, a public proof-of-concept exploit is available for EUVD-2025-203029. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for EUVD-2025-203029?

Yes, a patch is available for EUVD-2025-203029. Update the affected software to the latest version immediately.

py3-tornado EUVD-2025-203029

| CVE-2025-67726 HIGH

N/A vendor:alpine

GHSA-jhmp-mqwm-3gq8 PYSEC-2025-267

Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:35 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on tornado (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 6.5.3.

DescriptionCVE.org

Alpine Linux: py3-tornado fixed in 6.5.4-r0

AnalysisAI

py3-tornado in Alpine Linux received a security fix packaged as version 6.5.4-r0, addressing an unspecified vulnerability in the Tornado asynchronous Python web framework. The nature, severity, and impact of the underlying flaw are not disclosed in available intelligence - no CVE description, CVSS vector, or CWE classification has been published. With an EPSS score of 0.04% (11th percentile) and no public exploit identified at time of analysis, the current exploitation signal is very low, though the absence of severity data prevents meaningful risk contextualization.

Technical ContextAI

Tornado is an asynchronous, non-blocking Python web framework and networking library commonly used for building web applications, APIs, and real-time services. The affected package is py3-tornado, the Alpine Linux packaging of the upstream Tornado library. The Alpine package version 6.5.4-r0 follows the Alpine naming convention of <upstream_version>-r<package_revision>, suggesting upstream Tornado version 6.5.4 contains the fix. No CWE classification is available, so the root cause vulnerability class - whether it is a memory safety issue, injection flaw, authentication bypass, or other category - cannot be determined from current data. No CPE strings were provided to further narrow the affected component.

RemediationAI

Upgrade the py3-tornado package on Alpine Linux to version 6.5.4-r0 or later using the standard Alpine package manager: 'apk upgrade py3-tornado'. This is the vendor-released patch per the Alpine Linux advisory. The exact upstream Tornado fix version corresponding to Alpine package 6.5.4-r0 should be cross-referenced against the upstream Tornado changelog at the project's official site to confirm the specific security fix included. No workarounds or compensating controls can be specified because the vulnerability class and attack surface are unknown. If immediate patching is not possible, consider restricting network access to services running Tornado-based applications as a general precaution, noting this may impact availability of legitimate traffic.