CVE-2025-47287 Tornado vulnerable to excessive logging caused by malformed multipart form data
Remote attackers can cause denial of service in Tornado by sending malformed multipart form data that triggers excessive synchronous logging.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-47287?
CVE-2025-47287 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 15 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.
Weakness: CWE-770
Which versions are affected by CVE-2025-47287?
3 open source packages ship an affected version, including tornado. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
tornado PyPI | All versions | 6.5 |
tornado PyPI | All versions | 6.5 |
tornado PyPI | All versions | 6.5 |
Linux distribution packages (37)
python3-tornado AlmaLinux:10 | All versions | 6.4.2-1.el10_0.1 |
python3-tornado AlmaLinux:9 | All versions | 6.4.2-2.el9_6.2 |
python-tornado Red Hat:enterprise_linux:10.0 | All versions | 0:6.4.2-1.el10_0.1 |
python-tornado-debugsource Red Hat:enterprise_linux:10.0 | All versions | 0:6.4.2-1.el10_0.1 |
python3-tornado Red Hat:enterprise_linux:10.0 | All versions | 0:6.4.2-1.el10_0.1 |
python3-tornado-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:6.4.2-1.el10_0.1 |
python-tornado Red Hat:enterprise_linux:9::appstream | All versions | 0:6.4.2-2.el9_6.2 |
python-tornado-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:6.4.2-2.el9_6.2 |
python3-tornado Red Hat:enterprise_linux:9::appstream | All versions | 0:6.4.2-2.el9_6.2 |
python3-tornado-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:6.4.2-2.el9_6.2 |
python-tornado Red Hat:rhel_els:7 | All versions | 0:4.2.1-5.el7_9.1 |
python-tornado-debuginfo Red Hat:rhel_els:7 | All versions | 0:4.2.1-5.el7_9.1 |
python-tornado-doc Red Hat:rhel_els:7 | All versions | 0:4.2.1-5.el7_9.1 |
python-tornado Red Hat:rhel_eus:9.2::appstream | All versions | 0:6.4.2-1.el9_2.1 |
python-tornado-debugsource Red Hat:rhel_eus:9.2::appstream | All versions | 0:6.4.2-1.el9_2.1 |
python3-tornado Red Hat:rhel_eus:9.2::appstream | All versions | 0:6.4.2-1.el9_2.1 |
python3-tornado-debuginfo Red Hat:rhel_eus:9.2::appstream | All versions | 0:6.4.2-1.el9_2.1 |
python-tornado Red Hat:rhel_eus:9.4::appstream | All versions | 0:6.4.2-1.el9_4.1 |
python-tornado-debugsource Red Hat:rhel_eus:9.4::appstream | All versions | 0:6.4.2-1.el9_4.1 |
python3-tornado Red Hat:rhel_eus:9.4::appstream | All versions | 0:6.4.2-1.el9_4.1 |
python3-tornado-debuginfo Red Hat:rhel_eus:9.4::appstream | All versions | 0:6.4.2-1.el9_4.1 |
python-tornado Rocky Linux:10 | All versions | 0:6.4.2-1.el10_0.1 |
python-tornado Rocky Linux:9 | All versions | 0:6.4.2-2.el9_6.2 |
python-tornado SUSE:Enterprise Storage 7.1 | All versions | 4.5.3-150000.3.10.1 |
python-tornado SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 4.5.3-150000.3.10.1 |
python-tornado SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 4.5.3-150000.3.10.1 |
python-tornado6 SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 6.3.2-150400.9.9.1 |
python-tornado SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 4.5.3-150000.3.10.1 |
python-tornado6 SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 6.3.2-150400.9.9.1 |
python-tornado SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 4.5.3-150000.3.10.1 |
python-tornado6 SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 6.3.2-150400.9.9.1 |
python-tornado SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 4.5.3-150000.3.10.1 |
python-tornado6 SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 6.3.2-150400.9.9.1 |
python-tornado SUSE:Linux Enterprise Micro 5.2 | All versions | 4.5.3-150000.3.10.1 |
python-tornado SUSE:Linux Enterprise Micro 5.3 | All versions | 4.5.3-150000.3.10.1 |
python-tornado SUSE:Linux Enterprise Micro 5.4 | All versions | 4.5.3-150000.3.10.1 |
python-tornado SUSE:Linux Enterprise Micro 5.5 | All versions | 4.5.3-150000.3.10.1 |
Products include Debian Debian Linux, Tornadoweb Tornado.
How do I fix CVE-2025-47287?
Upgrade tornado to 6.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-47287 being exploited?
There is no known exploitation of CVE-2025-47287 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALSA-2025:8135, ALSA-2025:8136, AZL-61860, AZL-61866, CLEANSTART-2026-XW62361, CLSA-2026-1787299006 and 30 more.