{"id":"CVE-2025-47287","aliases":["ALSA-2025:8135","ALSA-2025:8136","ALSA-2025:8254","AZL-61860","AZL-61866","CLSA-2026-1772496774","CLSA-2026-1787299006","CLSA-2026-1790243751","CLSA-2026-1790610952","CLSA-2026-1790611274","CLSA-2026-1792168002","DEBIAN-CVE-2025-47287","DLA-4188-1","DSA-5938-1","EUVD-2025-15444","GHSA-7cx3-6m66-7c5m","MGASA-2025-0282","OESA-2025-1554","OESA-2025-1555","OESA-2025-1614","OESA-2025-1615","OESA-2025-1905","OESA-2025-2580","PYSEC-2026-1974","RHSA-2025:8135","RHSA-2025:8136","RHSA-2025:8223","RHSA-2025:8226","RHSA-2025:8254","RHSA-2025:8279","RHSA-2025:8290","RHSA-2025:8291","RHSA-2025:8323","RHSA-2025:8664","RLSA-2025:8135","RLSA-2025:8136","RLSA-2025:8254","ROOT-APP-PYPI-CVE-2025-47287","SUSE-EL-9-CLIENT-TOOLS-2025-2499","SUSE-SU-2025:01649-1","SUSE-SU-2025:01649-2","SUSE-SU-2025:01726-1","SUSE-SU-2025:01726-2","SUSE-SU-2025:01732-1","SUSE-SU-2025:02491-1","SUSE-SU-2025:02492-1","SUSE-SU-2025:02499-1","SUSE-SU-2025:02500-1","SUSE-SU-2025:02501-1","SUSE-SU-2025:02502-1","SUSE-SU-2025:02534-1","SUSE-SU-2025:20430-1","SUSE-SU-2025:20445-1","SUSE-SU-2025:20487-1","SUSE-SU-2025:20504-1","UBUNTU-CVE-2025-47287","USN-7547-1","openSUSE-SU-2025:15153-1","openSUSE-SU-2025:15295-1"],"status":"published","title":"Tornado vulnerable to excessive logging caused by malformed multipart form data","description":"Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00745,"percentile":0.5524,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2025-05-15T21:17:55Z","modified":"2026-11-06T20:00:36Z","fixes":[{"ecosystem":"PyPI","package":"tornado","fixed_in":["6.5"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:10","package":"python3-tornado","fixed_in":["6.4.2-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"python3-tornado","fixed_in":["6.4.2-2.el9_6.2"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"tornado","fixed_in":["5.1.1.post3+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-tornado","fixed_in":["6.2.0-3+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-tornado","fixed_in":["6.4.2-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-tornado","fixed_in":["6.4.2-2"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"python-tornado","fixed_in":["6.1.0-1+deb11u2"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"python-tornado","fixed_in":["6.3.2-1.2.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"python-tornado","fixed_in":["6.5-1.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"python-tornado","fixed_in":["6.5-1.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"python-tornado","fixed_in":["6.1-4.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"python-tornado","fixed_in":["6.1-4.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"pcs","fixed_in":["0.10.5-5.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"python-tornado","fixed_in":["5.0.2-10.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"python-tornado","fixed_in":["0:6.4.2-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"python-tornado-debugsource","fixed_in":["0:6.4.2-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"python3-tornado","fixed_in":["0:6.4.2-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"python3-tornado-debuginfo","fixed_in":["0:6.4.2-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-tornado","fixed_in":["0:6.4.2-2.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-tornado-debugsource","fixed_in":["0:6.4.2-2.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-tornado","fixed_in":["0:6.4.2-2.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-tornado-debuginfo","fixed_in":["0:6.4.2-2.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"python-tornado","fixed_in":["0:6.4.2-1.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"python-tornado-debugsource","fixed_in":["0:6.4.2-1.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"python3-tornado","fixed_in":["0:6.4.2-1.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"python3-tornado-debuginfo","fixed_in":["0:6.4.2-1.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"python-tornado","fixed_in":["0:6.4.2-1.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"python-tornado-debugsource","fixed_in":["0:6.4.2-1.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"python3-tornado","fixed_in":["0:6.4.2-1.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"python3-tornado-debuginfo","fixed_in":["0:6.4.2-1.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"python-tornado","fixed_in":["0:4.2.1-5.el7_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"python-tornado-debuginfo","fixed_in":["0:4.2.1-5.el7_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"python-tornado-doc","fixed_in":["0:4.2.1-5.el7_9.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"python-tornado","fixed_in":["0:6.4.2-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"python-tornado","fixed_in":["0:6.4.2-2.el9_6.2"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"tornado","fixed_in":["6.2+aikido.10","6.4.1+aikido.3","6.2+aikido.2","6.3.3+aikido.3","6.2+aikido.3","6.2+aikido.4","6.2+aikido.5","6.2+aikido.6","6.2+aikido.7","6.2+aikido.8","6.3.3+aikido.4","6.4.1+aikido.4","6.2+aikido.9","6.4.1+aikido.5","6.2+aikido.11","6.3.3+aikido.5","6.2+aikido.12"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"python-tornado6","fixed_in":["6.3.2-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-tornado6","fixed_in":["6.3.2-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-tornado6","fixed_in":["6.3.2-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-tornado6","fixed_in":["6.3.2-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-tornado6","fixed_in":["6.3.2-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-tornado6","fixed_in":["6.3.2-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-tornado6","fixed_in":["6.3.2-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-tornado6","fixed_in":["6.3.2-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-tornado6","fixed_in":["6.3.2-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"python-tornado6","fixed_in":["6.3.2-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-tornado6","fixed_in":["6.3.2-150400.9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"python-tornado","fixed_in":["4.5.3-150000.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"python-tornado","fixed_in":["4.5.3-150000.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"python-tornado","fixed_in":["4.5.3-150000.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"python-tornado","fixed_in":["4.5.3-150000.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"python-tornado","fixed_in":["4.5.3-150000.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-tornado","fixed_in":["4.5.3-150000.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-tornado","fixed_in":["4.5.3-150000.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-tornado","fixed_in":["4.5.3-150000.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-tornado","fixed_in":["4.5.3-150000.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"python-tornado","fixed_in":["4.5.3-150000.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-tornado","fixed_in":["4.5.3-150000.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-tornado","fixed_in":["4.5.3-150000.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"python-tornado","fixed_in":["4.5.3-150000.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-tornado","fixed_in":["4.5.3-150000.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-tornado","fixed_in":["4.5.3-150000.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"python-tornado","fixed_in":["4.5.3-150000.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"python-tornado","fixed_in":["4.5.3-150000.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"python-tornado","fixed_in":["4.5.3-150000.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"python-tornado","fixed_in":["4.5.3-150000.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python-tornado","fixed_in":["4.5.3-150000.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Client Tools 12","package":"python-tornado","fixed_in":["4.2.1-17.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"python-tornado6","fixed_in":["6.4-3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-tornado","fixed_in":["6.1.0-3ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"python-tornado","fixed_in":["6.4.0-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"python-tornado","fixed_in":["6.4.2-2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-tornado6","fixed_in":["6.5-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-2.el9_6.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.18-2.el8_10.5.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.18-2.el8_10.5.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.2.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.3.3-11"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1"},{"fixed":"6.1.0.post1+tuxcare"}]}],"versions":["6.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.1"},{"fixed":"5.1.1.post3+tuxcare"}]}],"versions":["5.1.1","5.1.1.post1+tuxcare","5.1.1.post2+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.18-2.el8.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.18-2.el8.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els2"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els2"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els2"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els2"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.4-7.el9_2.tuxcare.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.4-7.el9_2.tuxcare.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-3+deb12u2"}]}],"versions":["6.2.0-3","6.2.0-3+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-2"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0-1+deb11u2"}]}],"versions":["6.1.0-1","6.1.0-1+deb11u1"]},{"source":"osv","ecosystem":"Debian:12","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-3+deb12u2"}]}],"versions":["6.2.0-3","6.2.0-3+deb12u1"]},{"source":"osv","ecosystem":"PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5"}]}],"versions":["0.2","1.0","1.1","1.1.1","1.2","1.2.1","2.0","2.1","2.1.1","2.2","2.2.1","2.3","2.4","2.4.1","3.0","3.0.1","3.0.2","3.1","3.1.1","3.2","3.2.1","3.2.2","4.0","4.0.1","4.0.2","4.1","4.1b2","4.2","4.2.1","4.2b1","4.3","4.3b1","4.3b2","4.4","4.4.1","4.4.2","4.4.3","4.4b1","4.5","4.5.1","4.5.2","4.5.3","4.5b1","4.5b2","5.0","5.0.1","5.0.2","5.0a1","5.0b1","5.1","5.1.1","5.1b1","6.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0a1","6.0b1","6.1","6.1b1","6.1b2","6.2","6.2b1","6.2b2","6.3","6.3.1","6.3.2","6.3.3","6.3b1","6.4","6.4.1","6.4.2","6.4b1","6.5b1"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-1.2.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5-1.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5-1.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-4.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-4.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.5-5.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-10.oe2003sp4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5"}]}],"versions":["0.2","1.0","1.1","1.1.1","1.2","1.2.1","2.0","2.1","2.1.1","2.2","2.2.1","2.3","2.4","2.4.1","3.0","3.0.1","3.0.2","3.1","3.1.1","3.2","3.2.1","3.2.2","4.0","4.0.1","4.0.2","4.1","4.1b2","4.2","4.2.1","4.2b1","4.3","4.3b1","4.3b2","4.4","4.4.1","4.4.2","4.4.3","4.4b1","4.5","4.5.1","4.5.2","4.5.3","4.5b1","4.5b2","5.0","5.0.1","5.0.2","5.0a1","5.0b1","5.1","5.1.1","5.1b1","6.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0a1","6.0b1","6.1","6.1b1","6.1b2","6.2","6.2b1","6.2b2","6.3","6.3.1","6.3.2","6.3.3","6.3b1","6.4","6.4.1","6.4.2","6.4b1","6.5b1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-2.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-2.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-2.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-2.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"python-tornado-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"python3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"python3-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.15-4.el8_8.6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.15-4.el8_8.6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.15-4.el8_8.6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.15-4.el8_8.6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-5.el7_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"python-tornado-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-5.el7_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"python-tornado-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.1-5.el7_9.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-2.el9_6.2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2+aikido.10"},{"fixed":"6.4.1+aikido.3"},{"fixed":"6.2+aikido.2"},{"fixed":"6.3.3+aikido.3"},{"fixed":"6.2+aikido.3"},{"fixed":"6.2+aikido.4"},{"fixed":"6.2+aikido.5"},{"fixed":"6.2+aikido.6"},{"fixed":"6.2+aikido.7"},{"fixed":"6.2+aikido.8"},{"fixed":"6.3.3+aikido.4"},{"fixed":"6.4.1+aikido.4"},{"fixed":"6.2+aikido.9"},{"fixed":"6.4.1+aikido.5"},{"fixed":"6.2+aikido.11"},{"fixed":"6.3.3+aikido.5"},{"fixed":"6.2+aikido.12"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-1.59.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-150400.9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-150000.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-17.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-3.76.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150000.3.78.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150000.3.78.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150000.3.78.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150000.3.78.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.11-1.32.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.11-1.32.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-cython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.37-1.12.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-1.12.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4-1.21.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-m2crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.45.1-1.12.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-1.14.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-ply","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11-1.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-1.12.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"saltbundlepy-zypp-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.5-1.11.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:SaltBundle:Update","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-1.59.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-1.59.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150400.8.80.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150400.8.80.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150400.8.80.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150400.8.80.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150400.8.80.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150400.8.80.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150400.8.80.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150400.8.80.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150500.4.55.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150500.4.55.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150500.4.55.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Transactional Server 15 SP6","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150500.4.55.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150500.4.55.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150500.4.55.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150500.4.55.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150500.4.55.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150500.4.55.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"salt-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150500.4.55.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Systems Management 15 SP7","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150700.14.5.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150300.53.94.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150300.53.94.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150300.53.94.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150300.53.94.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150300.53.94.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150300.53.94.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4-3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4-slfo.1.1_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-slfo.1.1_4.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-13.1"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.1-1ubuntu2","4.2.1-1ubuntu3","4.2.1-1ubuntu3.1","4.2.1-1ubuntu3.1+esm1","4.2.1-1ubuntu3.1+esm2","4.2.1-1ubuntu3.1+esm3","4.2.1-1ubuntu3.1+esm4","4.2.1-1ubuntu3.1+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.1-2.1~build2","4.5.2-1","4.5.3-1","4.5.3-1ubuntu0.1","4.5.3-1ubuntu0.2","4.5.3-1ubuntu0.2+esm1","4.5.3-1ubuntu0.2+esm2","4.5.3-1ubuntu0.2+esm3","4.5.3-1ubuntu0.2+esm4","4.5.3-1ubuntu0.2+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.1-4ubuntu1","5.1.1-4ubuntu5","6.0.3+really5.1.1-2","6.0.3+really5.1.1-2build1","6.0.3+really5.1.1-2build2","6.0.3+really5.1.1-3","6.0.3+really5.1.1-3ubuntu0.1~esm1","6.0.3+really5.1.1-3ubuntu0.1~esm3","6.0.3+really5.1.1-3ubuntu0.1~esm5","6.0.3+really5.1.1-3ubuntu0.1~esm7","6.0.3+really5.1.1-3ubuntu0.1~esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0-3ubuntu0.1~esm2"}]}],"versions":["6.1.0-1build1","6.1.0-2","6.1.0-3","6.1.0-3build1","6.1.0-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-1ubuntu0.2"}]}],"versions":["6.3.2-1","6.4.0-0ubuntu1","6.4.0-1","6.4.0-1build1","6.4.0-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-2"}]}],"versions":["6.4.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0-3ubuntu0.1~esm2"}]}],"versions":["6.1.0-1build1","6.1.0-2","6.1.0-3","6.1.0-3build1","6.1.0-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-1ubuntu0.2"}]}],"versions":["6.3.2-1","6.4.0-0ubuntu1","6.4.0-1","6.4.0-1build1","6.4.0-1ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-41.1"}]}],"bundled":12}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"tornadoweb","product":"tornado"}],"references":[{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-7cx3-6m66-7c5m","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/tornadoweb/tornado/commit/b39b892bf78fe8fea01dd45199aa88307e7162f3","tags":["x_refsource_MISC","Patch","fix","web","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00038.html","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47287","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-7cx3-6m66-7c5m","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8135","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-47287","tags":["report"]},{"url":"https://bugzilla.redhat.com/2366703","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-8135.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8136","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-8136.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8254","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-46727","tags":["report"]},{"url":"https://bugzilla.redhat.com/2364966","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-8254.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1790243751.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49761","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52804","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46727","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59830","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61770","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61771","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61772","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61919","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31958","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1790610952.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1049","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38900","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45442","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27530","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27539","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1790611274.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792168002.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47287.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-47287","tags":["advisory"]},{"url":"https://github.com/tornadoweb/tornado","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0282.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34343","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7547-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1554","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1555","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1614","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1615","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1905","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2580","tags":["advisory"]},{"url":"https://pypi.org/project/tornado","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2366703","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8135.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-47287","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8136.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8223","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8223.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8226","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8226.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2364966","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8254.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-46727","tags":["advisory"]},{"url":"https://github.com/rack/rack/commit/2bb5263b464b65ba4b648996a579dbd180d2b712","tags":["article"]},{"url":"https://github.com/rack/rack/commit/3f5a4249118d09d199fe480466c8c6717e43b6e3","tags":["article"]},{"url":"https://github.com/rack/rack/commit/cd6b70a1f2a1016b73dc906f924869f4902c2d74","tags":["article"]},{"url":"https://github.com/rack/rack/security/advisories/GHSA-gjh7-p2fx-99vx","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8279","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8279.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8290","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8290.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8291","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8291.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8323","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8323.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8664","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8664.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:8135","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:8136","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:8254","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement//suse-el-9-client-tools-2025-2499/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236621","tags":["report"]},{"url":"https://bugzilla.suse.com/1243268","tags":["report"]},{"url":"https://bugzilla.suse.com/1244561","tags":["report"]},{"url":"https://bugzilla.suse.com/1244564","tags":["report"]},{"url":"https://bugzilla.suse.com/1244565","tags":["report"]},{"url":"https://bugzilla.suse.com/1244566","tags":["report"]},{"url":"https://bugzilla.suse.com/1244567","tags":["report"]},{"url":"https://bugzilla.suse.com/1244568","tags":["report"]},{"url":"https://bugzilla.suse.com/1244570","tags":["report"]},{"url":"https://bugzilla.suse.com/1244571","tags":["report"]},{"url":"https://bugzilla.suse.com/1244572","tags":["report"]},{"url":"https://bugzilla.suse.com/1244574","tags":["report"]},{"url":"https://bugzilla.suse.com/1244575","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47287","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501649-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501649-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501726-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501726-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501732-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502491-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502492-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502499-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502500-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502501-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502502-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502534-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520430-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520445-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1233668","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52804","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520487-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520504-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236877","tags":["report"]},{"url":"https://bugzilla.suse.com/1238686","tags":["report"]},{"url":"https://bugzilla.suse.com/1238849","tags":["report"]},{"url":"https://bugzilla.suse.com/1238929","tags":["report"]},{"url":"https://bugzilla.suse.com/1240626","tags":["report"]},{"url":"https://bugzilla.suse.com/1240698","tags":["report"]},{"url":"https://bugzilla.suse.com/1242174","tags":["report"]},{"url":"https://bugzilla.suse.com/1243105","tags":["report"]},{"url":"https://bugzilla.suse.com/1243274","tags":["report"]},{"url":"https://bugzilla.suse.com/1243297","tags":["report"]},{"url":"https://bugzilla.suse.com/1243802","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-47287","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UONXT4J4OCDF5HUKE3ESBSBHQZIGVTZ2/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-47287","title":"Tornado vulnerable to excessive logging caused by malformed multipart form data","description":"Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.","status":"published","published":"2025-05-15T21:17:55.188Z","modified":"2025-05-29T06:04:05.899Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:32:25.982948Z"}],"euvd":[{"id":"EUVD-2025-15444","description":"Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.","status":"published","published":"2025-05-15T21:17:55Z","modified":"2025-05-29T06:04:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:36.215224Z"}],"ghsa":[{"id":"GHSA-7cx3-6m66-7c5m","title":"Tornado vulnerable to excessive logging caused by malformed multipart form data","description":"### Summary\n\nWhen Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous.\n\n### Affected versions\n\nAll versions of Tornado prior to 6.5 are affected. The vulnerable parser is enabled by default.\n\n### Solution\n\nUpgrade to Tornado version 6.5. In the meantime, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.","status":"published","published":"2025-05-16T14:12:40Z","modified":"2025-05-29T06:32:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:38:44.991725Z"}],"nvd":[{"id":"CVE-2025-47287","description":"Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.","status":"published","published":"2025-05-15T22:15:18.827Z","modified":"2026-06-17T09:27:40.32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:11:08.321805Z"}],"osv":[{"id":"CVE-2025-47287","title":"Tornado vulnerable to excessive logging caused by malformed multipart form data","description":"Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.","status":"published","published":"2025-05-15T21:17:55.188Z","modified":"2026-10-28T02:30:40.439584523Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:44:49.707645Z"},{"id":"DEBIAN-CVE-2025-47287","description":"Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.","status":"published","published":"2025-05-15T22:15:18.827Z","modified":"2026-09-01T20:03:35.182116219Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"GHSA-7cx3-6m66-7c5m","title":"Tornado vulnerable to excessive logging caused by malformed multipart form data","description":"### Summary\n\nWhen Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous.\n\n### Affected versions\n\nAll versions of Tornado prior to 6.5 are affected. The vulnerable parser is enabled by default.\n\n### Solution\n\nUpgrade to Tornado version 6.5. In the meantime, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.","status":"published","published":"2025-05-16T14:12:40Z","modified":"2026-09-10T03:50:24.284224963Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:41.002603Z"},{"id":"OESA-2025-1554","title":"python-tornado security update","description":"Tornado is an open source version of the scalable, non-blocking web server and tools.\r\n\r\nSecurity Fix(es):\n\nTornado is a Python web framework and asynchronous networking library. When Tornado\u0026apos;s ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.(CVE-2025-47287)","status":"published","published":"2025-05-23T11:08:39Z","modified":"2026-08-18T01:17:59.201991862Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1555","title":"python-tornado security update","description":"Tornado is an open source version of the scalable, non-blocking web server and tools.\r\n\r\nSecurity Fix(es):\n\nTornado is a Python web framework and asynchronous networking library. When Tornado\u0026apos;s ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.(CVE-2025-47287)","status":"published","published":"2025-05-23T11:08:39Z","modified":"2026-08-18T01:17:59.279590341Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1614","title":"python-tornado security update","description":"Tornado is an open source version of the scalable, non-blocking web server and tools.\r\n\r\nSecurity Fix(es):\n\nTornado is a Python web framework and asynchronous networking library. When Tornado\u0026apos;s ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.(CVE-2025-47287)","status":"published","published":"2025-06-06T11:08:42Z","modified":"2026-08-18T01:17:59.941426706Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1615","title":"python-tornado security update","description":"Tornado is an open source version of the scalable, non-blocking web server and tools.\r\n\r\nSecurity Fix(es):\n\nTornado is a Python web framework and asynchronous networking library. When Tornado\u0026apos;s ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.(CVE-2025-47287)","status":"published","published":"2025-06-06T11:08:42Z","modified":"2026-08-18T01:18:51.512971367Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1905","title":"pcs security update","description":"pcs is a corosync and pacemaker configuration tool.  It permits users to easily view, modify and create pacemaker based clusters.\r\n\r\nSecurity Fix(es):\n\nTornado is a Python web framework and asynchronous networking library. When Tornado\u0026apos;s ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.(CVE-2025-47287)","status":"published","published":"2025-07-25T11:08:59Z","modified":"2026-08-18T01:18:55.620007576Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2580","title":"python-tornado security update","description":"Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived connection to each user.\r\n\r\nSecurity Fix(es):\n\nTornado is a Python web framework and asynchronous networking library. When Tornado\u0026apos;s ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.(CVE-2025-47287)","status":"published","published":"2025-10-31T11:09:40Z","modified":"2026-08-18T01:19:16.827451246Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"PYSEC-2026-1974","title":"Tornado vulnerable to excessive logging caused by malformed multipart form data","description":"### Summary\n\nWhen Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous.\n\n### Affected versions\n\nAll versions of Tornado prior to 6.5 are affected. The vulnerable parser is enabled by default.\n\n### Solution\n\nUpgrade to Tornado version 6.5. In the meantime, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.","status":"published","published":"2026-07-07T16:02:52.554242Z","modified":"2026-07-07T17:48:11.550822648Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"RHSA-2025:8135","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2025-05-27T10:03:16Z","modified":"2026-07-12T10:06:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8136","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2025-05-27T10:03:17Z","modified":"2026-07-12T10:06:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8223","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2025-05-28T10:07:49Z","modified":"2026-07-12T10:06:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8226","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2025-05-28T10:07:49Z","modified":"2026-07-12T10:06:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8254","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2025-05-29T10:03:29Z","modified":"2026-10-17T10:07:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8279","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2025-05-29T10:03:31Z","modified":"2026-10-17T10:07:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8290","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2025-05-29T10:03:33Z","modified":"2026-10-17T10:07:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8291","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2025-05-29T10:03:33Z","modified":"2026-10-17T10:07:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8323","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2025-05-30T10:03:23Z","modified":"2026-10-17T10:07:24Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8664","title":"Red Hat Security Advisory: python-tornado security update","status":"published","published":"2025-06-10T10:02:56Z","modified":"2026-07-12T10:06:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RLSA-2025:8135","title":"Important: python-tornado security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-08T17:12:40.950812Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2025:8136","title":"Important: python-tornado security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-04T00:11:30.91642Z","modified":"2025-10-07T17:39:41.36499Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2025:8254","title":"Important: pcs security update","description":"The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.\n\nSecurity Fix(es):\n\n* rubygem-rack: Unbounded-Parameter DoS in Rack::QueryParser (CVE-2025-46727)\n\n* tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:38:44.782224Z","modified":"2025-07-29T15:00:29.054089Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"ROOT-APP-PYPI-CVE-2025-47287","title":"CVE-2025-47287 in tornado - Patched by Root","description":"Root has patched CVE-2025-47287 in the tornado package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-10-12T08:34:51Z","modified":"2026-10-12T09:15:04.640257804Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"UBUNTU-CVE-2025-47287","description":"Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.","status":"published","published":"2025-05-15T22:15:00Z","modified":"2026-11-06T20:00:36.122339774Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T20:07:08.647364Z"},{"id":"ALSA-2025:8135","title":"Important: python-tornado security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-26T00:00:00Z","modified":"2026-10-29T11:58:17.112869Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:8136","title":"Important: python-tornado security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-26T00:00:00Z","modified":"2026-10-29T11:32:17.212620134Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:8254","title":"Important: pcs security update","description":"The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.  \n\nSecurity Fix(es):  \n\n  * rubygem-rack: Unbounded-Parameter DoS in Rack::QueryParser (CVE-2025-46727)\n  * tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-28T00:00:00Z","modified":"2026-10-29T11:02:23.097611774Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"AZL-61860","title":"CVE-2025-47287 affecting package python-tornado 6.2.0-1","description":"Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.","status":"published","published":"2025-05-15T22:15:18Z","modified":"2026-04-21T04:31:52.071209Z","updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"AZL-61866","title":"CVE-2025-47287 affecting package python-tornado 6.3.3-11","description":"Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.","status":"published","published":"2025-05-15T22:15:18Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"CLSA-2026-1772496774","title":"TuxCare security update for tornado (2 CVEs)","description":"TuxCare rebuilt tornado to address 2 CVEs. Fixed in 6.1.0.post1+tuxcare.","status":"published","published":"2026-08-04T14:52:09Z","modified":"2026-10-15T09:48:05.138700162Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1787299006","title":"TuxCare security update for tornado (1 CVE)","description":"TuxCare rebuilt tornado to address 1 CVE. Fixed in 5.1.1.post3+tuxcare.","status":"published","published":"2026-08-21T07:56:46Z","modified":"2026-10-15T09:48:05.82876427Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1790243751","title":"pcs: Fix of 10 CVEs","description":"- CVE-2025-46727: unbounded query parsing in bundled rack; a body of repeated\n  keys was parsed in full, exhausting memory. Capped by rack's new query\n  bytesize and parameter-count limits, which pcsd turns into an HTTP 400\n- CVE-2025-59830: the same unbounded query parse reached through ';' separated\n  query strings, which rack's parameter counter did not count\n- CVE-2025-61770: multipart parsing in bundled rack read the whole request body\n  searching for a boundary that never arrived\n- CVE-2025-61771: multipart parsing in bundled rack retained an unbounded\n  non-file field in memory\n- CVE-2025-61772: multipart mime part headers in bundled rack were read with no\n  size limit\n- CVE-2025-61919: Rack::Request#POST read the entire request body before any\n  limit applied, so a 64 MB body was fully buffered\n- CVE-2024-49761: quadratic regular expression in bundled rexml\n  BaseParser#unnormalize; a long run of zeros in a hex character reference made\n  the parser hang\n- CVE-2024-52804: quadratic cookie unquoting in bundled tornado\n  _unquote_cookie, which rescanned the value from each escape\n- CVE-2025-47287: malformed multipart/form-data in bundled tornado logged a\n  warning per bad part instead of rejecting the request, flooding the log\n- CVE-2026-31958: unbounded part count and part header size in bundled tornado\n  multipart parsing\n- Stop forwarding client HTTP headers from the Tornado front end to the Ruby\n  part of pcsd, which only ever needed the cookie and the content type","status":"published","published":"2026-09-24T09:56:11Z","modified":"2026-10-26T09:43:44.481328861Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790610952","title":"pcs: Fix of 7 CVEs","description":"- CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords\n- CVE-2022-38900: fix DoS in decode() of bundled decode-uri-component\n- CVE-2022-45442: fix reflected file download in bundled sinatra attachment()\n- CVE-2023-27530: fix multipart part count DoS in rack (via rack 2.2.20)\n- CVE-2023-27539: fix ReDoS in rack header parsing (via rack 2.2.20)\n- CVE-2024-52804: fix quadratic cookie parsing in bundled tornado\n- CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado","status":"published","published":"2026-09-28T15:56:09Z","modified":"2026-10-26T09:31:44.061169655Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790611274","title":"pcs: Fix of 7 CVEs","description":"- CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords\n- CVE-2022-38900: fix DoS in decode() of bundled decode-uri-component\n- CVE-2022-45442: fix reflected file download in bundled sinatra attachment()\n- CVE-2023-27530: fix multipart part count DoS in rack (via rack 2.2.20)\n- CVE-2023-27539: fix ReDoS in rack header parsing (via rack 2.2.20)\n- CVE-2024-52804: fix quadratic cookie parsing in bundled tornado\n- CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado","status":"published","published":"2026-09-28T16:01:31Z","modified":"2026-10-26T09:31:51.368414759Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792168002","title":"pcs: Fix of 3 CVEs","description":"- CVE-2026-31958: cap multipart part count and part header size in bundled tornado, and stop accepting multipart requests in pcsd\n- CVE-2024-52804: fix quadratic cookie parsing in bundled tornado\n- CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado","status":"published","published":"2026-10-16T16:26:53Z","modified":"2026-10-26T09:43:51.563039982Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"DLA-4188-1","title":"python-tornado - security update","status":"published","published":"2025-05-29T00:00:00Z","modified":"2026-03-09T02:09:29.302256Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-5938-1","title":"python-tornado - security update","status":"published","published":"2025-06-06T00:00:00Z","modified":"2026-03-09T01:21:40.089803Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2025-0282","title":"Updated python-tornado packages fix security vulnerability","description":"Tornado vulnerable to excessive logging caused by malformed multipart\nform data. (CVE-2025-47287)\n","status":"published","published":"2025-11-12T21:29:34Z","modified":"2026-04-16T04:42:43.780828708Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15153-1","title":"python311-tornado6-6.5-1.1 on GA media","description":"These are all security issues fixed in the python311-tornado6-6.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-23T00:00:00Z","modified":"2026-03-23T04:53:24.728755Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:15295-1","title":"python311-salt-3006.0-41.1 on GA media","description":"These are all security issues fixed in the python311-salt-3006.0-41.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:36.339505Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"SUSE-EL-9-CLIENT-TOOLS-2025-2499","title":"Security update 5.0.5 for Multi-Linux Manager Salt Bundle","description":"This update fixes the following issues:\n\nvenv-salt-minion:\n    \n- Security issues fixed:\n  \n  - CVE-2024-38822: Fixed Minion token validation (bsc#1244561)\n  - CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport (bsc#1244564)\n  - CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)\n  - CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)\n  - CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)\n  - CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)\n  - CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)\n  - CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)\n  - CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack (bsc#1244572)\n  - CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574) \n  - CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)\n  - CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)\n\n- Other bugs fixed:\n\n  - Added subsystem filter to udev.exportdb (bsc#1236621)\n  - Fixed Ubuntu 24.04 test failures\n  - Fixed refresh of osrelease and related grains on Python 3.10+\n  - Fixed issue requiring proper Python flavor for dependencies\n  - Fixed VIRTUAL_ENV variable in activate file to point to actual path\n  - Fixed the bundle path in pyvenv.cfg\n  - Prevent tests failures when pygit2 is not present\n\n","status":"published","published":"2025-07-23T12:46:00Z","modified":"2026-07-24T18:24:19.648178682Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2025:01649-1","title":"Security update for python-tornado6","description":"This update for python-tornado6 fixes the following issues:\n    \n- CVE-2025-47287: excessive logging when parsing malformed `multipart/form-data` can lead to a denial-of-service\n  (bsc#1243268).\n","status":"published","published":"2025-05-22T07:44:54Z","modified":"2026-02-04T03:06:48.682379Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:01649-2","title":"Security update for python-tornado6","description":"This update for python-tornado6 fixes the following issues:\n    \n- CVE-2025-47287: excessive logging when parsing malformed `multipart/form-data` can lead to a denial-of-service\n  (bsc#1243268).\n","status":"published","published":"2025-05-23T11:58:50Z","modified":"2026-03-23T04:48:26.726505Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:01726-1","title":"Security update for python-tornado","description":"This update for python-tornado fixes the following issues:\n\n- CVE-2025-47287: excessive logging when parsing malformed `multipart/form-data` can lead to a denial-of-service\n  (bsc#1243268).  \n","status":"published","published":"2025-05-28T13:46:00Z","modified":"2026-03-23T04:47:36.241155Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:01726-2","title":"Security update for python-tornado","description":"This update for python-tornado fixes the following issues:\n\n- CVE-2025-47287: excessive logging when parsing malformed `multipart/form-data` can lead to a denial-of-service\n  (bsc#1243268).  \n","status":"published","published":"2025-06-06T09:51:13Z","modified":"2026-03-23T04:46:21.91683Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:01732-1","title":"Security update for python-tornado","description":"This update for python-tornado fixes the following issues:\n\n- CVE-2025-47287: excessive logging when parsing malformed `multipart/form-data` can lead to a denial-of-service\n  (bsc#1243268).\n","status":"published","published":"2025-05-28T14:44:51Z","modified":"2025-05-29T12:44:02.478185Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:02491-1","title":"Security update 5.0.5 for Multi-Linux Manager Salt Bundle","description":"This update fixes the following issues:\n\nvenv-salt-minion:\n    \n- Security issues fixed:\n  \n  - CVE-2024-38822: Fixed Minion token validation (bsc#1244561)\n  - CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport (bsc#1244564)\n  - CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)\n  - CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)\n  - CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)\n  - CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)\n  - CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)\n  - CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)\n  - CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack (bsc#1244572)\n  - CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574) \n  - CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)\n  - CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)\n\n- Other bugs fixed:\n\n  - Added subsystem filter to udev.exportdb (bsc#1236621)\n  - Fixed Ubuntu 24.04 test failures\n  - Fixed refresh of osrelease and related grains on Python 3.10+\n  - Fixed issue requiring proper Python flavor for dependencies\n  - Fixed VIRTUAL_ENV variable in activate file to point to actual path\n  - Fixed the bundle path in pyvenv.cfg\n  - Prevent tests failures when pygit2 is not present\n\n","status":"published","published":"2025-07-23T12:43:13Z","modified":"2026-03-23T04:48:36.470595Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02492-1","title":"Security update 5.0.5 for Multi-Linux Manager Salt Bundle","description":"This update fixes the following issues:\n\nvenv-salt-minion:\n    \n- Security issues fixed:\n  \n  - CVE-2024-38822: Fixed Minion token validation (bsc#1244561)\n  - CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport (bsc#1244564)\n  - CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)\n  - CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)\n  - CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)\n  - CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)\n  - CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)\n  - CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)\n  - CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack (bsc#1244572)\n  - CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574) \n  - CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)\n  - CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)\n\n- Other bugs fixed:\n\n  - Added subsystem filter to udev.exportdb (bsc#1236621)\n  - Fixed Ubuntu 24.04 test failures\n  - Fixed refresh of osrelease and related grains on Python 3.10+\n  - Fixed issue requiring proper Python flavor for dependencies\n  - Fixed VIRTUAL_ENV variable in activate file to point to actual path\n  - Fixed the bundle path in pyvenv.cfg\n  - Prevent tests failures when pygit2 is not present\n\n","status":"published","published":"2025-07-23T12:43:53Z","modified":"2026-03-23T04:47:46.886127Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02499-1","title":"Security update 5.0.5 for Multi-Linux Manager Salt Bundle","description":"This update fixes the following issues:\n\nvenv-salt-minion:\n    \n- Security issues fixed:\n  \n  - CVE-2024-38822: Fixed Minion token validation (bsc#1244561)\n  - CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport (bsc#1244564)\n  - CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)\n  - CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)\n  - CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)\n  - CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)\n  - CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)\n  - CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)\n  - CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack (bsc#1244572)\n  - CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574) \n  - CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)\n  - CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)\n\n- Other bugs fixed:\n\n  - Added subsystem filter to udev.exportdb (bsc#1236621)\n  - Fixed Ubuntu 24.04 test failures\n  - Fixed refresh of osrelease and related grains on Python 3.10+\n  - Fixed issue requiring proper Python flavor for dependencies\n  - Fixed VIRTUAL_ENV variable in activate file to point to actual path\n  - Fixed the bundle path in pyvenv.cfg\n  - Prevent tests failures when pygit2 is not present\n\n","status":"published","published":"2025-07-23T12:46:00Z","modified":"2026-03-23T04:47:47.135427Z","updated_at":"2026-11-02T15:53:56.647031Z"}]},"sources_more":{"osv":9}}