CVE-2025-47287 Tornado vulnerable to excessive logging caused by malformed multipart form data

🗓️ 15 May 2025 21:17:55Reported by GitHub_MType

Tornado vulnerable to excessive logging from malformed multipart form data allowing DoS attacks.

Reporter	Title	Published	Views	Family All 211
IBM Security Bulletins	Security Bulletin: Tornado multipart/form-data Parser Vulnerability Enables Log-Based DoS Attack (Pre-6.5.0), which affects IBM watsonx.data	1 Sep 202514:49	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affecting IBM Watson Studio in Cloud Pak for Data Are Addressed	28 Aug 202509:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to tornado-6.4.2-cp38-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl CVE-2025-47287	1 Sep 202513:06	–	ibm
Tenable Nessus	Amazon Linux 2023 : python3-tornado (ALAS2023-2025-1002)	12 Jun 202500:00	–	nessus
Tenable Nessus	Amazon Linux 2 : python-tornado (ALAS-2025-2888)	12 Jun 202500:00	–	nessus
Tenable Nessus	Amazon Linux 2 : python3-tornado (ALAS-2025-2889)	12 Jun 202500:00	–	nessus
Tenable Nessus	AlmaLinux 9 : python-tornado (ALSA-2025:8136)	27 May 202500:00	–	nessus
Tenable Nessus	Debian dla-4188 : python-tornado-doc - security update	29 May 202500:00	–	nessus
Tenable Nessus	Debian dsa-5938 : python-tornado-doc - security update	6 Jun 202500:00	–	nessus
Tenable Nessus	MiracleLinux 9 : python-tornado-6.4.2-2.el9_6.2 (AXSA:2025-10491:02)	13 Jan 202600:00	–	nessus

[
  {
    "vendor": "tornadoweb",
    "product": "tornado",
    "versions": [
      {
        "version": "< 6.5.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/tornadoweb/tornado/commit/b39b892bf78fe8fea01dd45199aa88307e7162f3
github	www.github.com/tornadoweb/tornado/security/advisories/GHSA-7cx3-6m66-7c5m

15 May 2025 21:17Current

CVSS 3.17.5

EPSS0.00672

CWE-770