CVE-2025-47287

Summary

When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous.

Affected versions

All versions of Tornado prior to 6.5 are affected. The vulnerable parser is enabled by default.

Solution

Upgrade to Tornado version 6.5. In the meantime, risk can be mitigated by blocking Content-Type: multipart/form-data in a proxy.

Tornado is an open source version of the scalable, non-blocking web server and tools.

Security Fix(es):

Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking Content-Type: multipart/form-data in a proxy.(CVE-2025-47287)

Tornado is an open source version of the scalable, non-blocking web server and tools.

Security Fix(es):

Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking Content-Type: multipart/form-data in a proxy.(CVE-2025-47287)

Tornado is an open source version of the scalable, non-blocking web server and tools.

Security Fix(es):

Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking Content-Type: multipart/form-data in a proxy.(CVE-2025-47287)

Tornado is an open source version of the scalable, non-blocking web server and tools.

Security Fix(es):

Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking Content-Type: multipart/form-data in a proxy.(CVE-2025-47287)

pcs is a corosync and pacemaker configuration tool. It permits users to easily view, modify and create pacemaker based clusters.

Security Fix(es):

Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking Content-Type: multipart/form-data in a proxy.(CVE-2025-47287)

Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived connection to each user.

Security Fix(es):

Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking Content-Type: multipart/form-data in a proxy.(CVE-2025-47287)

Summary

When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous.

Affected versions

All versions of Tornado prior to 6.5 are affected. The vulnerable parser is enabled by default.

Solution

Upgrade to Tornado version 6.5. In the meantime, risk can be mitigated by blocking Content-Type: multipart/form-data in a proxy.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• rubygem-rack: Unbounded-Parameter DoS in Rack::QueryParser (CVE-2025-46727)

• tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2025-47287 in the tornado package for Root:PyPI. Multiple fixed versions available.

Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking Content-Type: multipart/form-data in a proxy.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• rubygem-rack: Unbounded-Parameter DoS in Rack::QueryParser (CVE-2025-46727)
• tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking Content-Type: multipart/form-data in a proxy.

Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking Content-Type: multipart/form-data in a proxy.

TuxCare rebuilt tornado to address 2 CVEs. Fixed in 6.1.0.post1+tuxcare.

TuxCare rebuilt tornado to address 1 CVE. Fixed in 5.1.1.post3+tuxcare.

• CVE-2025-46727: unbounded query parsing in bundled rack; a body of repeated keys was parsed in full, exhausting memory. Capped by rack's new query bytesize and parameter-count limits, which pcsd turns into an HTTP 400
• CVE-2025-59830: the same unbounded query parse reached through ';' separated query strings, which rack's parameter counter did not count
• CVE-2025-61770: multipart parsing in bundled rack read the whole request body searching for a boundary that never arrived
• CVE-2025-61771: multipart parsing in bundled rack retained an unbounded non-file field in memory
• CVE-2025-61772: multipart mime part headers in bundled rack were read with no size limit
• CVE-2025-61919: Rack::Request#POST read the entire request body before any limit applied, so a 64 MB body was fully buffered
• CVE-2024-49761: quadratic regular expression in bundled rexml BaseParser#unnormalize; a long run of zeros in a hex character reference made the parser hang
• CVE-2024-52804: quadratic cookie unquoting in bundled tornado _unquote_cookie, which rescanned the value from each escape
• CVE-2025-47287: malformed multipart/form-data in bundled tornado logged a warning per bad part instead of rejecting the request, flooding the log
• CVE-2026-31958: unbounded part count and part header size in bundled tornado multipart parsing
• Stop forwarding client HTTP headers from the Tornado front end to the Ruby part of pcsd, which only ever needed the cookie and the content type

• CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords
• CVE-2022-38900: fix DoS in decode() of bundled decode-uri-component
• CVE-2022-45442: fix reflected file download in bundled sinatra attachment()
• CVE-2023-27530: fix multipart part count DoS in rack (via rack 2.2.20)
• CVE-2023-27539: fix ReDoS in rack header parsing (via rack 2.2.20)
• CVE-2024-52804: fix quadratic cookie parsing in bundled tornado
• CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado

• CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords
• CVE-2022-38900: fix DoS in decode() of bundled decode-uri-component
• CVE-2022-45442: fix reflected file download in bundled sinatra attachment()
• CVE-2023-27530: fix multipart part count DoS in rack (via rack 2.2.20)
• CVE-2023-27539: fix ReDoS in rack header parsing (via rack 2.2.20)
• CVE-2024-52804: fix quadratic cookie parsing in bundled tornado
• CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado

• CVE-2026-31958: cap multipart part count and part header size in bundled tornado, and stop accepting multipart requests in pcsd
• CVE-2024-52804: fix quadratic cookie parsing in bundled tornado
• CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado

Tornado vulnerable to excessive logging caused by malformed multipart form data. (CVE-2025-47287)

These are all security issues fixed in the python311-tornado6-6.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-salt-3006.0-41.1 package on the GA media of openSUSE Tumbleweed.

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
  • CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport (bsc#1244564)
  • CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
  • CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
  • CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
  • CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
  • CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
  • CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
  • CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack (bsc#1244572)
  • CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
  • CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
  • CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

• Other bugs fixed:

  • Added subsystem filter to udev.exportdb (bsc#1236621)
  • Fixed Ubuntu 24.04 test failures
  • Fixed refresh of osrelease and related grains on Python 3.10+
  • Fixed issue requiring proper Python flavor for dependencies
  • Fixed VIRTUAL_ENV variable in activate file to point to actual path
  • Fixed the bundle path in pyvenv.cfg
  • Prevent tests failures when pygit2 is not present

This update for python-tornado6 fixes the following issues:

• CVE-2025-47287: excessive logging when parsing malformed multipart/form-data can lead to a denial-of-service (bsc#1243268).

This update for python-tornado6 fixes the following issues:

• CVE-2025-47287: excessive logging when parsing malformed multipart/form-data can lead to a denial-of-service (bsc#1243268).

This update for python-tornado fixes the following issues:

• CVE-2025-47287: excessive logging when parsing malformed multipart/form-data can lead to a denial-of-service (bsc#1243268).

This update for python-tornado fixes the following issues:

• CVE-2025-47287: excessive logging when parsing malformed multipart/form-data can lead to a denial-of-service (bsc#1243268).

This update for python-tornado fixes the following issues:

• CVE-2025-47287: excessive logging when parsing malformed multipart/form-data can lead to a denial-of-service (bsc#1243268).

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
  • CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport (bsc#1244564)
  • CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
  • CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
  • CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
  • CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
  • CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
  • CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
  • CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack (bsc#1244572)
  • CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
  • CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
  • CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

• Other bugs fixed:

  • Added subsystem filter to udev.exportdb (bsc#1236621)
  • Fixed Ubuntu 24.04 test failures
  • Fixed refresh of osrelease and related grains on Python 3.10+
  • Fixed issue requiring proper Python flavor for dependencies
  • Fixed VIRTUAL_ENV variable in activate file to point to actual path
  • Fixed the bundle path in pyvenv.cfg
  • Prevent tests failures when pygit2 is not present

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
  • CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport (bsc#1244564)
  • CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
  • CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
  • CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
  • CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
  • CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
  • CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
  • CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack (bsc#1244572)
  • CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
  • CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
  • CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

• Other bugs fixed:

  • Added subsystem filter to udev.exportdb (bsc#1236621)
  • Fixed Ubuntu 24.04 test failures
  • Fixed refresh of osrelease and related grains on Python 3.10+
  • Fixed issue requiring proper Python flavor for dependencies
  • Fixed VIRTUAL_ENV variable in activate file to point to actual path
  • Fixed the bundle path in pyvenv.cfg
  • Prevent tests failures when pygit2 is not present

This update fixes the following issues:

venv-salt-minion:

• Security issues fixed:

  • CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
  • CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport (bsc#1244564)
  • CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
  • CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
  • CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
  • CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
  • CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
  • CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
  • CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack (bsc#1244572)
  • CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
  • CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
  • CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

• Other bugs fixed:

  • Added subsystem filter to udev.exportdb (bsc#1236621)
  • Fixed Ubuntu 24.04 test failures
  • Fixed refresh of osrelease and related grains on Python 3.10+
  • Fixed issue requiring proper Python flavor for dependencies
  • Fixed VIRTUAL_ENV variable in activate file to point to actual path
  • Fixed the bundle path in pyvenv.cfg
  • Prevent tests failures when pygit2 is not present