tornado

- `.StaticFileHandler` no longer follows symlinks outside of the static root directory.
  Applications that wish to continue the previous behavior may set the new argument
  ``allowed_symlink_directory`` to the directory (an ancestor of the static root) that
  should be used for symlink validation. Thanks to `afldl <https://github.com/afldl>`_ and
  `iaokhut-from-NightWolf-Team <https://github.com/iaokhut-from-NightWolf-Team>`_ for
  reporting this issue.
- ``curl_httpclient`` has a new ``max_body_size`` argument (default 100MB, same as
  for ``simple_httpclient``). This limit is enforced on all requests, whether or not
  ``streaming_callback`` is used. ``curl_httpclient`` now also controls its memory usage
  when decompressing response bodies. Thanks to `afldl <https://github.com/afldl>`_,
  `iaohkut-from-NightWolf-Team <https://github.com/iaohkut-from-NightWolf-Team>`_, and
  `aoto-tech <https://github.com/aoto-tech>`_ for reporting this issue.
- ``simple_httpclient`` now correctly applies the ``max_body_size`` limit to responses
  using HTTP/1.0 format (no ``Content-Length`` or ``Transfer-Encoding``). Previously it
  silently truncated such responses at ``max_buffer_size`` instead. Thanks to
  `afldl <https://github.com/afldl>`_ for reporting this issue.
- ``simple_httpclient`` now rejects responses that use more than 10 ``100 Continue`` responses,
  which could previously cause stack overflow errors. Thanks to `afldl <https://github.com/afldl>`_
  for reporting this issue.
- The limit ``ParseBodyConfig.urlencoded.max_argument`` is now applied to URL arguments
  in addition to ``POST`` bodies. Thanks to
  `iaohkut-from-NightWolf-Team <https://github.com/iaohkut-from-NightWolf-Team>`_,
  `afldl <https://github.com/afldl>`_, and `manus-pi <https://github.com/manus-pi>`_
  for reporting this issue.

Bug fixes
~~~~~~~~~

`tornado.iostream`

- Form-encoded ``POST`` bodies are now subject to a limit of 1000 arguments by default. This
  prevents a CPU and memory denial of service attack. This limit can be overridden via the
  `.set_parse_body_config` function. Thanks to `Arpit Jain <https://github.com/arpitjain099>`_
  for reporting this issue.
- Multipart parsing now rejects requests with an excessive number of parts earlier in the parsing
  process, limiting memory consumption. Thanks to `afldl <https://github.com/afldl>`_ for
  reporting this issue.
- The deprecated mixed-case arguments to `.RequestHandler.set_cookie` now enforce the same
  restrictions on invalid characters that were introduced in Tornado 6.5.5 for the standard
  lowercase arguments. Thanks to `sec-reex <https://github.com/sec-reex>`_ and
  `Arpit Jain <https://github.com/arpitjain099>`_ for reporting this issue.

Deprecations
~~~~~~~~~~~~

- The `.OpenIdMixin` class is deprecated and will be removed in Tornado 6.7. OpenID 2.0 is no
  longer widely supported by identity providers.

- ``CurlAsyncHTTPClient`` now fully resets the curl object before reusing it. This prevents
  incorrectly reusing options from a previous request, specifically including client SSL and
  credentials used for accessing proxies. Thanks to `Koh Jun Sheng <https://github.com/seankohjs>`_
  for reporting this issue.

- ``SimpleAsyncHTTPClient`` now strips the ``Authorization`` and ``Cookie`` headers from the request
  when following a redirect to a different origin. This matches the default behavior of
  ``CurlAsyncHTTPClient``. Applications that need different behavior here can set
  ``follow_redirects=False`` and handle redirects manually. Thanks to [Yannick
  Wang](https://github.com/noobone123) for being first to report this issue, as well as additional
  reporters [Kai Aizen](https://github.com/SnailSploit), [HunSec](https://github.com/0xHunSec), and
  [Thai Son Dinh](https://github.com/sondt99).
- ``SimpleAsyncHTTPClient`` now enforces ``max_body_size`` on the decompressed size of the response,
  rather than the compressed size. This prevents a denial-of-service attack via a very large
  compressed response. Thanks to [Yuichiro Kedashiro](https://github.com/yuui25) for reporting this
  issue.
- Fixed a bug in the C extension that could have read up to three bytes past the end of an input
  array. Thanks to [Thai Son Dinh](https://github.com/sondt99) for reporting this issue.
- ``OpenIDMixin`` has improved parsing for the ``check_authentication`` response. Thanks to
  [Yannick Wang](https://github.com/noobone123) for reporting this issue.

Bug fixes
~~~~~~~~~

- ``CurlAsyncHTTPClient`` has been updated to use non-deprecated APIs, avoiding deprecation
  warnings with recent versions of ``pycurl``.

- ``multipart/form-data`` requests are now limited to 100 parts by default, to prevent a
  denial-of-service attack via very large requests with many parts. This limit is configurable
  via `tornado.httputil.ParseMultipartConfig`. Multipart parsing can also be disabled completely
  if not required for the application. Thanks to [0x-Apollyon](https://github.com/0x-Apollyon) and
  [bekkaze](https://github.com/bekkaze) for reporting this issue.
- The ``domain``, ``path``, and ``samesite`` arguments to `.RequestHandler.set_cookie` are now
  validated for illegal characters, which could be abused to inject other attributes on the cookie.
  Thanks to Dhiral Vyas (Praetorian) for reporting this issue.
- Carriage return characters are no longer accepted in ``multipart/form-data`` headers. Thanks to
  [sergeykochanov](https://github.com/sergeykochanov) for reporting this issue.

- The ``in`` operator for ``HTTPHeaders`` was incorrectly case-sensitive, causing
  lookups to fail for headers with different casing than the original header name.
  This was a regression in version 6.5.3 and has been fixed to restore the intended
  case-insensitive behavior from version 6.5.2 and earlier.

- Fixed a denial-of-service vulnerability involving quadratic computation when parsing
  ``multipart/form-data`` request bodies.
  `CVE-2025-67726 <https://github.com/tornadoweb/tornado/security/advisories/GHSA-jhmp-mqwm-3gq8>`_
  Thanks to `Finder16 <https://github.com/Finder16>`_ for reporting this issue.
- Fixed a denial-of-service vulnerability involving quadratic computation when parsing repeated HTTP
  headers.
  `CVE-2025-67725 <https://github.com/tornadoweb/tornado/security/advisories/GHSA-c98p-7wgm-6p64>`_.
  Thanks to `Finder16 <https://github.com/Finder16>`_ for reporting this issue.
- Fixed a header injection and XSS vulnerability involving the ``reason`` argument to
  `.RequestHandler.set_status` and `tornado.web.HTTPError`.
  `CVE-2025-67724 <https://github.com/tornadoweb/tornado/security/advisories/GHSA-pr2v-jx2c-wg9f>`_.
  Thanks to `Finder16 <https://github.com/Finder16>`_ and
  `Cheshire1225 <https://github.com/Cheshire1225>`_ for reporting this issue.

Demo changes
~~~~~~~~~~~~
- Several demo applications bundled with the Tornado repo (``blog``, ``chat``, ``facebook``) had an
  open redirect vulnerability which has been fixed. This is not covered by a CVE or security
  advisory since the demo applications are not included as a part of the Tornado package when
  installed, but developers who have copied code from these demos may which to review their own
  applications for open redirects. Thanks to `J1vvoo <https://github.com/J1vvoo>`_ for reporting this
  issue.
- The ``s3server`` demo application contained some path traversal vulnerabilities. Since this demo
  application was not demonstrating any interesting aspects of Tornado, it has been deleted rather
  than being fixed. Thanks to `J1vvoo <https://github.com/J1vvoo>`_ for reporting this issue.

- Fixed a bug that resulted in WebSocket pings not being sent at the configured interval.
- Improved logging for invalid ``Host`` headers. This was previouisly logged as an uncaught
  exception with a stack trace, now it is simply a 400 response (logged as a warning in the
  access log)
- Restored the ``host`` argument to ``.HTTPServerRequest``. This argument is deprecated
  and will be removed in the future, but its removal with no warning in 6.5.0 was a mistake.
- Removed a debugging print statement that was left in the code.
- Improved type hints for ``gen.multi``.

- Fixed a bug in ``multipart/form-data`` parsing that could incorrectly reject filenames containing
  characters above U+00FF (i.e. most characters outside the Latin alphabet).