High RHSA-2025:8664 1 CVE

Red Hat Security Advisory: python-tornado security update

Published Jun 10, 2025 · Updated Jul 12, 2026

Ecosystem: Red Hat

Fixed packages 3

Release	Package	Fixed in
Red Hat · RHEL 7 ELS rhel_els:7	python-tornado	0:4.2.1-5.el7_9.1
Red Hat · RHEL 7 ELS rhel_els:7	python-tornado-debuginfo	0:4.2.1-5.el7_9.1
Red Hat · RHEL 7 ELS rhel_els:7	python-tornado-doc	0:4.2.1-5.el7_9.1

Vulnerabilities 1

High 7.5

CVE-2025-47287

Tornado vulnerable to excessive logging caused by malformed multipart form data

Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate…

tornadoweb tornado airflow-3 kubeflow-pipelines-visualization-server Debian Ubuntu Azure Linux Wolfi PyPI

May 15, 2025

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2366703
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8664.json
report
https://access.redhat.com/security/cve/CVE-2025-47287
advisory
https://www.cve.org/CVERecord?id=CVE-2025-47287
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-47287
article
https://github.com/tornadoweb/tornado/commit/b39b892bf78fe8fea01dd45199aa88307e7162f3
article
https://github.com/tornadoweb/tornado/security/advisories/GHSA-7cx3-6m66-7c5m