Tornado vulnerable to excessive logging caused by malformed multipart form data
Priority MEDIUM 40CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 16 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.
Summary
Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00745 55th percentileScored 2026-11-07
Fix Partial tornado (tornadoweb): 6.5.0tornado (PyPI): 6.5Red Hat: 10 advisoriesRed Hat: 16 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tornadoweb | tornado | before 6.5.0 | 6.5.0 | Patch available | CNA |
| — | tornado (PyPI) | before 6.5 | 6.5 | Patch available | GHSA-7cx3-6m66-7c5m |
- tornado Vendortornadoweb Affected before 6.5.0 Fixed in 6.5.0 Patch available CNA
- tornado (PyPI) Vendor— Affected before 6.5 Fixed in 6.5 Patch available GHSA-7cx3-6m66-7c5m
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:* | before 6.5.0 | Vulnerable | tornadoweb |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
- cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:* Versions before 6.5.0 Vulnerable ·tornadoweb
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
Remediation
- Fix · CNA tornado (tornadoweb) Fixed in 6.5.0
- Fix · GHSA-7cx3-6m66-7c5m tornado (PyPI) Fixed in 6.5 Advisory →
Red Hat 10 advisories
- RHSA-2025:8664 Released 2025-06-09 · Red Hat rating Importantpython-tornado security update
- Red Hat Enterprise Linux Server Optional (v. 7 ELS) python-tornado-4.2.1-5.el7_9.1, python-tornado-doc-4.2.1-5.el7_9.1
- RHSA-2025:8323 Released 2025-05-29 · Red Hat rating Importantpcs security update
- Red Hat Enterprise Linux High Availability AUS (v.8.4) pcs-0.10.8-1.el8_4.7, pcs-snmp-0.10.8-1.el8_4.7
- Red Hat Enterprise Linux HighAvailability E4S (v.8.4) pcs-0.10.8-1.el8_4.7, pcs-snmp-0.10.8-1.el8_4.7
- Red Hat Enterprise Linux HighAvailability TUS (v.8.4) pcs-0.10.8-1.el8_4.7, pcs-snmp-0.10.8-1.el8_4.7
- RHSA-2025:8291 Released 2025-05-29 · Red Hat rating Importantpcs security update
- Red Hat Enterprise Linux High Availability E4S (v.9.0) pcs-0.11.1-10.el9_0.8, pcs-snmp-0.11.1-10.el9_0.8
- Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) pcs-0.11.1-10.el9_0.8, pcs-snmp-0.11.1-10.el9_0.8
Show 7 more Red Hat advisories
- RHSA-2025:8290 Released 2025-05-29 · Red Hat rating Importantpcs security update
- Red Hat Enterprise Linux High Availability E4S (v.8.6) pcs-0.10.12-6.el8_6.8, pcs-snmp-0.10.12-6.el8_6.8
- Red Hat Enterprise Linux High Availability TUS (v.8.6) pcs-0.10.12-6.el8_6.8, pcs-snmp-0.10.12-6.el8_6.8
- RHSA-2025:8279 Released 2025-05-28 · Red Hat rating Importantpcs security update
- Red Hat Enterprise Linux High Availability EUS (v.8.8) pcs-0.10.15-4.el8_8.6, pcs-snmp-0.10.15-4.el8_8.6
- Red Hat Enterprise Linux Resilient Storage EUS (v.8.8) pcs-0.10.15-4.el8_8.6, pcs-snmp-0.10.15-4.el8_8.6
- RHSA-2025:8254 Released 2025-05-28 · Red Hat rating Importantpcs security update
- Red Hat Enterprise Linux HighAvailability (v. 8) pcs-0.10.18-2.el8_10.5, pcs-snmp-0.10.18-2.el8_10.5
- Red Hat Enterprise Linux ResilientStorage (v. 8) pcs-0.10.18-2.el8_10.5, pcs-snmp-0.10.18-2.el8_10.5
- RHSA-2025:8226 Released 2025-05-27 · Red Hat rating Importantpython-tornado security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) python-tornado-6.4.2-1.el9_2.1, python3-tornado-6.4.2-1.el9_2.1
- RHSA-2025:8223 Released 2025-05-27 · Red Hat rating Importantpython-tornado security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) python-tornado-6.4.2-1.el9_4.1, python3-tornado-6.4.2-1.el9_4.1
- RHSA-2025:8136 Released 2025-05-26 · Red Hat rating Importantpython-tornado security update
- Red Hat Enterprise Linux AppStream (v. 9) python-tornado-6.4.2-2.el9_6.2, python3-tornado-6.4.2-2.el9_6.2
- RHSA-2025:8135 Released 2025-05-26 · Red Hat rating Importantpython-tornado security update
- Red Hat Enterprise Linux AppStream (v. 10) python-tornado-6.4.2-1.el10_0.1, python3-tornado-6.4.2-1.el10_0.1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2025:8135 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2025:8136 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2025:8226 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2025:8223 |
| Red Hat Enterprise Linux High Availability AUS (v.8.4) | Fixed | RHSA-2025:8323 |
| Red Hat Enterprise Linux High Availability E4S (v.8.6) | Fixed | RHSA-2025:8290 |
| Red Hat Enterprise Linux High Availability E4S (v.9.0) | Fixed | RHSA-2025:8291 |
| Red Hat Enterprise Linux High Availability EUS (v.8.8) | Fixed | RHSA-2025:8279 |
| Red Hat Enterprise Linux High Availability TUS (v.8.6) | Fixed | RHSA-2025:8290 |
| Red Hat Enterprise Linux HighAvailability (v. 8) | Fixed | RHSA-2025:8254 |
| Red Hat Enterprise Linux HighAvailability E4S (v.8.4) | Fixed | RHSA-2025:8323 |
| Red Hat Enterprise Linux HighAvailability TUS (v.8.4) | Fixed | RHSA-2025:8323 |
| Red Hat Enterprise Linux Resilient Storage EUS (v.8.8) | Fixed | RHSA-2025:8279 |
| Red Hat Enterprise Linux ResilientStorage (v. 8) | Fixed | RHSA-2025:8254 |
| Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) | Fixed | RHSA-2025:8291 |
| Red Hat Enterprise Linux Server Optional (v. 7 ELS) | Fixed | RHSA-2025:8664 |
Not affected: 1 product
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2025-47287
- 2026-10-03 Alias added: GHSA-7cx3-6m66-7c5m
References
Advisory 3
More tornadoweb Tornado vulnerabilities
- TI-2026-24502 Tornado has a DoS due to too many multipart parts CVSS 4.0HIGH 8.7
- TI-2024-35317 Tornado has HTTP cookie parsing DoS vulnerability CVSS 3.1HIGH 7.5
- TI-2025-41422 Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters CVSS 3.1HIGH 7.5
- TI-2025-41421 Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing CVSS 3.1HIGH 7.5
- TI-2026-27646 In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path… CVSS 3.1HIGH 7.2
- TI-2014-07904 Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be… CVSS 3.1MEDIUM 6.5
Sources
- CVE-2025-47287 · CVE Program
- CVE-2025-47287 · NVD
- FIRST EPSS
- GHSA-7cx3-6m66-7c5m · GitHub Advisory Database · CC BY 4.0
- CVE-2025-47287 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences