CVE-2025-47287

python3-tornado: Tornado is a Python web framework and asynchronous networking library

CVE-2025-47287 is fixed in 10 products on 1 platform, first by python3-tornado 6.1.0-3ubuntu0.1~esm2, released May 15, 2025. It is not reported as exploited. Patch Radar priority: High.

High
CVSS
7.5
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0075
55th percentile

Tornado is a Python web framework and asynchronous networking library. WhenTornado's ``multipart/form-data`` parser encounters certain errors, it logsa warning but continues trying to parse the remainder of the data. Thisallows remote attackers to generate an extremely high volume of logs,constituting a DoS attack. This DoS is compounded by the fact that thelogging subsystem is synchronous. All versions of Tornado prior to 6.5.0are affected. The vulnerable parser is enabled by default. Upgrade toTornado version 6.50 to receive a patch. As a workaround, risk can bemitigated by blocking `Content-Type: multipart/form-data` in a proxy.

Where it's fixed

ProductFixed inFixReleased
Linux
pcs · RHEL 8 0:0.10.18-2.el8_10.5 RHSA-2025:8254 May 28, 2025
pcs · almalinux 8 0.10.18-2.el8_10.5.alma.1 ALSA-2025:8254 May 28, 2025
pcs · ol 8 0:0.10.18-2.0.1.el8_10.5 ELSA-2025-8254 May 28, 2025
pcs · rocky 8 0:0.10.18-2.el8_10.5 RLSA-2025:8254 Jul 29, 2025
pcs-snmp · RHEL 8 0:0.10.18-2.el8_10.5 RHSA-2025:8254 May 28, 2025
pcs-snmp · almalinux 8 0.10.18-2.el8_10.5.alma.1 ALSA-2025:8254 May 28, 2025
pcs-snmp · ol 8 0:0.10.18-2.0.1.el8_10.5 ELSA-2025-8254 May 28, 2025
python-tornado · Debian 11.6 (bullseye) 6.1.0-1+deb11u2 DLA-4188-1 May 29, 2025
python-tornado · Debian 12.15 (bookworm) 6.2.0-3+deb12u2 DSA-5938-1 Jun 6, 2025
python-tornado · Debian 13.5 (trixie) 6.4.2-2 DEBIAN-CVE-2025-47287 May 15, 2025
python-tornado · Debian 14 6.4.2-2 DEBIAN-CVE-2025-47287 May 15, 2025
python-tornado · RHEL 10 6.4.2-1.el10_0.1 RHSA-2025:8135 May 15, 2025
python-tornado · rocky 10 0:6.4.2-1.el10_0.1 RLSA-2025:8135 Oct 3, 2025
python-tornado · rocky 9 0:6.4.2-2.el9_6.2 RLSA-2025:8136 Oct 4, 2025
python-tornado · sles 15.6 4.5.3-150000.3.10.1 SUSE-SU-2025:01726-1 May 28, 2025
python-tornado · sles 15.7 4.5.3-150000.3.10.1 SUSE-SU-2025:01726-2 Jun 6, 2025
python-tornado-debugsource · amzn 2023 6.1.0-2.amzn2023.0.5 ALAS2023-2025-1002 Jun 4, 2025
python-tornado-doc · amzn 2023 6.1.0-2.amzn2023.0.5 ALAS2023-2025-1002 Jun 4, 2025
python-tornado6 · opensuse-leap 15.6 6.3.2-150400.9.9.1 SUSE-SU-2025:01649-1 May 22, 2025
python-tornado6 · sles 15.6 6.3.2-150400.9.9.1 SUSE-SU-2025:01649-1 May 22, 2025
python-tornado6 · sles 15.7 6.3.2-150400.9.9.1 SUSE-SU-2025:01649-2 May 23, 2025
python3-tornado · RHEL 9 0:6.4.2-2.el9_6.2 RHSA-2025:8136 May 26, 2025
python3-tornado · Ubuntu 22.04.1 LTS (jammy) 6.1.0-3ubuntu0.1~esm2 python3-tornado 6.1.0-3ubuntu0.1~esm2 May 15, 2025
python3-tornado · Ubuntu 24.04.5 LTS (noble) 6.4.0-1ubuntu0.2 python3-tornado 6.4.0-1ubuntu0.2 May 15, 2025
python3-tornado · Ubuntu 24.10 (oracular) 6.4.1-2ubuntu0.2 python3-tornado 6.4.1-2ubuntu0.2 Jan 16, 2026
python3-tornado · Ubuntu 25.04 (plucky) 6.4.2-1ubuntu0.25.04.1 python3-tornado 6.4.2-1ubuntu0.25.04.1 Jan 16, 2026
python3-tornado · Ubuntu 25.10 (questing) 6.4.2-2 python3-tornado 6.4.2-2 May 15, 2025
python3-tornado · almalinux 10 6.4.2-1.el10_0.1 ALSA-2025:8135 May 26, 2025
python3-tornado · almalinux 9 6.4.2-2.el9_6.2 ALSA-2025:8136 May 26, 2025
python3-tornado · amzn 2023 6.1.0-2.amzn2023.0.5 ALAS2023-2025-1002 Jun 4, 2025
python3-tornado · ol 10 0:6.4.2-1.el10_0.1 ELSA-2025-8135 Jun 26, 2025
python3-tornado · ol 9 0:6.4.2-2.el9_6.2 ELSA-2025-8136 May 26, 2025
python3-tornado-debuginfo · amzn 2023 6.1.0-2.amzn2023.0.5 ALAS2023-2025-1002 Jun 4, 2025
salt · opensuse-leap 15.6 3006.0-150500.4.55.1 SUSE-SU-2025:02501-1 Jul 23, 2025
salt · sles 15.6 3006.0-150500.4.55.1 SUSE-SU-2025:02501-1 Jul 23, 2025
salt · sles 15.7 3006.0-150700.14.5.2 SUSE-SU-2025:02502-1 Jul 23, 2025
salt-test · opensuse-leap 15.6 3006.0-150500.4.55.1 SUSE-SU-2025:02501-1 Jul 23, 2025

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.