What is the CVSS score of EUVD-2025-203032?

EUVD-2025-203032 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2025-203032?

Yes, a patch is available for EUVD-2025-203032. Update the affected software to the latest version immediately.

py3-tornado EUVD-2025-203032

| CVE-2025-67724 MEDIUM

N/A vendor:alpine

GHSA-pr2v-jx2c-wg9f PYSEC-2025-265

Information Disclosure

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:36 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on tornado (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 6.5.3.

DescriptionCVE.org

Alpine Linux: py3-tornado fixed in 6.5.4-r0

AnalysisAI

py3-tornado (the Python Tornado web framework packaged for Alpine Linux) contains a vulnerability addressed in Alpine package version 6.5.4-r0. The nature of the flaw - including its impact class, affected component, and exploitability - is not disclosed in available intelligence. The only confirmed remediation signal is the Alpine Linux vendor advisory fixing the package at version 6.5.4-r0. EPSS exploitation probability is very low at 0.03% (11th percentile), and no active exploitation or public proof-of-concept has been identified at time of analysis.

Technical ContextAI

Tornado is a Python web framework and asynchronous networking library widely used for high-concurrency applications, WebSocket servers, and non-blocking I/O services. The Alpine Linux package py3-tornado bundles the upstream Tornado library for Alpine-based systems (including Docker containers and edge deployments). The Alpine package version 6.5.4-r0 corresponds to upstream Tornado 6.5.4. No CWE is assigned, so the root cause class - whether HTTP parsing flaw, memory mismanagement, logic error, or other - cannot be determined from available data. No CPE strings were provided to further scope affected configurations.

RemediationAI

The primary fix is to upgrade the py3-tornado Alpine package to version 6.5.4-r0 or later using the Alpine package manager: 'apk upgrade py3-tornado'. This is the only confirmed remediation action from available data. No workarounds or compensating controls are documented because the vulnerability type is unknown - generic controls cannot be responsibly recommended without knowing the flaw class. For Alpine-based Docker images, rebuild using a base image that pulls py3-tornado >= 6.5.4-r0. No advisory URL beyond the Alpine Linux package repository was provided in the source data.