Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.

The version of python-tornado installed on the remote host is prior to 4.2.1-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2888 advisory.

    Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-     data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of     the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS     attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of     Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado     version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type:
    multipart/form-data` in a proxy. (CVE-2025-47287)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python3-tornado installed on the remote host is prior to 5.0.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2889 advisory.

    Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-     data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of     the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS     attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of     Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado     version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type:
    multipart/form-data` in a proxy. (CVE-2025-47287)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1002 advisory.

    Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-     data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of     the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS     attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of     Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado     version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type:
    multipart/form-data` in a proxy. (CVE-2025-47287)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8664 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:01726-2 advisory.

    - CVE-2025-47287: excessive logging when parsing malformed `multipart/form-data` can lead to a denial-of-     service       (bsc#1243268).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5938 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5938-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 06, 2025                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : python-tornado     CVE ID         : CVE-2025-47287

    It was discovered that the Tornado Python web framework performed     excessive logging when parsing some multipart/form-data requests, which     could result in denial of service.

    For the stable distribution (bookworm), this problem has been fixed in     version 6.2.0-3+deb12u2.

    We recommend that you upgrade your python-tornado packages.

    For the detailed security status of python-tornado please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-tornado

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:8135 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has a package installed that is affected by a vulnerability as referenced in the USN-7547-1 advisory.

    It was discovered that Tornado inefficiently handled requests when parsing certain form data. An attacker     could possibly use this issue to increase resource utilization leading to a denial of service. This issue     was only addressed in Ubuntu 24.04 LTS and Ubuntu 22.04 LTS. (CVE-2025-47287)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8323 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Unbounded-Parameter DoS in Rack::QueryParser (CVE-2025-46727)

    * tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-8254 advisory.

    - Fixed CVE-2024-52804 by patching bundled Tornado       Resolves: RHEL-93167

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8291 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Unbounded-Parameter DoS in Rack::QueryParser (CVE-2025-46727)

    * tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8290 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Unbounded-Parameter DoS in Rack::QueryParser (CVE-2025-46727)

    * tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:01726-1 advisory.

    - CVE-2025-47287: excessive logging when parsing malformed `multipart/form-data` can lead to a denial-of-     service       (bsc#1243268).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8279 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Unbounded-Parameter DoS in Rack::QueryParser (CVE-2025-46727)

    * tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4188 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4188-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     May 29, 2025                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-tornado     Version        : 6.1.0-1+deb11u2     CVE ID         : CVE-2025-47287     Debian Bug     : 1105886

    Tornado is a scalable, non-blocking Python web framework and     asynchronous networking library.

    CVE-2025-47287

       When Tornado's 'multipart/form-data' parser encounters certain        errors, it logs a warning but continues trying to parse the        remainder of the data. This allows remote attackers to generate an        extremely high volume of logs, constituting a DoS attack. This DoS        is compounded by the fact that the logging subsystem is synchronous.

    For Debian 11 bullseye, this problem has been fixed in version     6.1.0-1+deb11u2.

    We recommend that you upgrade your python-tornado packages.

    For the detailed security status of python-tornado please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-tornado

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8254 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Unbounded-Parameter DoS in Rack::QueryParser (CVE-2025-46727)

    * tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:8223 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:8226 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2025:8136 advisory.

    * tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-8136 advisory.

    [6.4.2-2.2]
    - tests: add ci_test.fmf + update gating.yaml       Related: RHEL-91999

    [6.4.2-2.1]
    - httputil: Raise errors instead of logging in  multipart/form-data parsing       Resolves: RHEL-91999

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:8136 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:01649-2 advisory.

    - CVE-2025-47287: excessive logging when parsing malformed `multipart/form-data` can lead to a denial-of-     service       (bsc#1243268).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The detected version of the Tornado Python package, Tornado, is prior to 6.4.2.
It is therefore affected by a DoS vulnerability that happens When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous.:

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:01649-1 advisory.

    - CVE-2025-47287: excessive logging when parsing malformed `multipart/form-data` can lead to a denial-of-     service       (bsc#1243268).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
238365	Amazon Linux 2 : python-tornado (ALAS-2025-2888)	Nessus	Amazon Linux Local Security Checks	high
238349	Amazon Linux 2 : python3-tornado (ALAS-2025-2889)	Nessus	Amazon Linux Local Security Checks	high
238281	Amazon Linux 2023 : python3-tornado (ALAS2023-2025-1002)	Nessus	Amazon Linux Local Security Checks	high
237974	RHEL 7 : python-tornado (RHSA-2025:8664)	Nessus	Red Hat Local Security Checks	high
237923	SUSE SLED15 / SLES15 Security Update : python-tornado (SUSE-SU-2025:01726-2)	Nessus	SuSE Local Security Checks	high
237913	Debian dsa-5938 : python-tornado-doc - security update	Nessus	Debian Local Security Checks	high
237827	RHEL 10 : python-tornado (RHSA-2025:8135)	Nessus	Red Hat Local Security Checks	high
237708	Ubuntu 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : Tornado vulnerability (USN-7547-1)	Nessus	Ubuntu Local Security Checks	high
237488	RHEL 8 : pcs (RHSA-2025:8323)	Nessus	Red Hat Local Security Checks	high
237460	Oracle Linux 8 : pcs (ELSA-2025-8254)	Nessus	Oracle Linux Local Security Checks	high
237456	RHEL 9 : pcs (RHSA-2025:8291)	Nessus	Red Hat Local Security Checks	high
237453	RHEL 8 : pcs (RHSA-2025:8290)	Nessus	Red Hat Local Security Checks	high
237439	SUSE SLED15 / SLES15 Security Update : python-tornado (SUSE-SU-2025:01726-1)	Nessus	SuSE Local Security Checks	high
237435	RHEL 8 : pcs (RHSA-2025:8279)	Nessus	Red Hat Local Security Checks	high
237433	Debian dla-4188 : python-tornado-doc - security update	Nessus	Debian Local Security Checks	high
237410	RHEL 8 : pcs (RHSA-2025:8254)	Nessus	Red Hat Local Security Checks	high
237390	RHEL 9 : python-tornado (RHSA-2025:8223)	Nessus	Red Hat Local Security Checks	high
237341	RHEL 9 : python-tornado (RHSA-2025:8226)	Nessus	Red Hat Local Security Checks	high
237270	AlmaLinux 9 : python-tornado (ALSA-2025:8136)	Nessus	Alma Linux Local Security Checks	high
237265	Oracle Linux 9 : python-tornado (ELSA-2025-8136)	Nessus	Oracle Linux Local Security Checks	high
237243	RHEL 9 : python-tornado (RHSA-2025:8136)	Nessus	Red Hat Local Security Checks	high
237218	SUSE SLED15 / SLES15 Security Update : python-tornado6 (SUSE-SU-2025:01649-2)	Nessus	SuSE Local Security Checks	high
237199	Python Library Tornado 6.5.0 DoS	Nessus	Misc.	high
237167	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-tornado6 (SUSE-SU-2025:01649-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2025-47287

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high