Summary
It was discovered that Tornado inefficiently handled requests when
parsing certain form data. An attacker could possibly use this issue to
increase resource utilization leading to a denial of service. This issue
was only addressed in Ubuntu 24.04 LTS and Ubuntu 22.04 LTS.
(CVE-2025-47287)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | python-tornado | 6.4.0-1ubuntu0.2 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | python-tornado | 6.1.0-3ubuntu0.1~esm2 |
Vulnerabilities 1
-
High 7.5
Tornado vulnerable to excessive logging caused by malformed multipart form data
Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate…
References
-
report
https://ubuntu.com/security/CVE-2025-47287