Description
Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tornadoweb | tornado | < 6.5.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-tornado | 6.4.2-2 | — |
| Debian 13 | python-tornado | 6.4.2-2 | — |
| Debian 12 | python-tornado | 6.2.0-3+deb12u2 | DSA-5938-1 |
| Debian 11 | python-tornado | 6.1.0-1+deb11u2 | DLA-4188-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | python-tornado | 6.4.2-2 | — |
| Ubuntu 24.04 LTS | python-tornado | 6.4.0-1ubuntu0.2 | USN-7547-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | python-tornado | 6.1.0-3ubuntu0.1~esm2 | USN-7547-1 |
| Ubuntu Pro 20.04 LTS | python-tornado | No fix yet | — |
| Ubuntu Pro 18.04 LTS | python-tornado | No fix yet | — |
| Ubuntu Pro 16.04 LTS | python-tornado | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | python-tornado +1 | 6.4.2-1.el10_0.1 | RHSA-2025:8135 |
| RHEL 9 | python-tornado +1 | 6.4.2-2.el9_6.2 | RHSA-2025:8136 |
| RHEL 8 | pcs +1 | 0.10.18-2.el8_10.5 | RHSA-2025:8254 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | python-tornado +1 | 6.4.2-1.el9_4.1 | RHSA-2025:8223 |
| RHEL 9.2 EUS | python-tornado +1 | 6.4.2-1.el9_2.1 | RHSA-2025:8226 |
| RHEL 9.0 E4S | pcs +1 | 0.11.1-10.el9_0.8 | RHSA-2025:8291 |
| RHEL 8.8 EUS | pcs +1 | 0.10.15-4.el8_8.6 | RHSA-2025:8279 |
| RHEL 8.6 TUS | pcs +1 | 0.10.12-6.el8_6.8 | RHSA-2025:8290 |
| RHEL 8.6 E4S | pcs +1 | 0.10.12-6.el8_6.8 | RHSA-2025:8290 |
| RHEL 8.4 TUS | pcs +1 | 0.10.8-1.el8_4.7 | RHSA-2025:8323 |
| RHEL 8.4 E4S | pcs +1 | 0.10.8-1.el8_4.7 | RHSA-2025:8323 |
| RHEL 8.4 AUS | pcs +1 | 0.10.8-1.el8_4.7 | RHSA-2025:8323 |
| RHEL 7 ELS | python-tornado +1 | 4.2.1-5.el7_9.1 | RHSA-2025:8664 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | python3-tornado | 6.4.2-1.el10_0.1 | ALSA-2025:8135 |
| AlmaLinux 9 | python3-tornado | 6.4.2-2.el9_6.2 | ALSA-2025:8136 |
| AlmaLinux 8 | pcs +1 | 0.10.18-2.el8_10.5.alma.1 | ALSA-2025:8254 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | python-tornado | 6.4.2-1.el10_0.1 | RLSA-2025:8135 |
| Rocky Linux 9 | python-tornado | 6.4.2-2.el9_6.2 | RLSA-2025:8136 |
| Rocky Linux 8 | pcs | 0.10.18-2.el8_10.5 | RLSA-2025:8254 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | python-tornado | 4.5.3-150000.3.10.1 | SUSE-SU-2025:01726-2 |
| SLES 15 SP7 | salt | 3006.0-150700.14.5.2 | SUSE-SU-2025:02502-1 |
| SLES 15 SP6 | python-tornado | 4.5.3-150000.3.10.1 | SUSE-SU-2025:01726-1 |
| SLES 15 SP6 | salt | 3006.0-150500.4.55.1 | SUSE-SU-2025:02501-1 |
| SLES 15 SP5 | python-tornado | 4.5.3-150000.3.10.1 | SUSE-SU-2025:01726-1 |
| SLES 15 SP5 | python-tornado6 | 6.3.2-150400.9.9.1 | SUSE-SU-2025:01649-1 |
| SLES 15 SP5 | salt | 3006.0-150500.4.55.1 | SUSE-SU-2025:02501-1 |
| SLES 15 SP4 | python-tornado | 4.5.3-150000.3.10.1 | SUSE-SU-2025:01726-1 |
| SLES 15 SP4 | python-tornado6 | 6.3.2-150400.9.9.1 | SUSE-SU-2025:01649-1 |
| SLES 15 SP4 | salt | 3006.0-150400.8.80.1 | SUSE-SU-2025:02500-1 |
| SLES 15 SP3 | python-tornado | 4.5.3-150000.3.10.1 | SUSE-SU-2025:01726-1 |
| SLES 15 SP3 | salt | 3006.0-150300.53.94.1 | SUSE-SU-2025:02534-1 |
Show 24 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 3 | python-tornado6 | 6.3.2-150400.9.9.1 | SUSE-SU-2025:01649-2, SUSE-SU-2025:01649-1 |
| SLES for SAP 15 SP5 | python-tornado | 4.5.3-150000.3.10.1 | SUSE-SU-2025:01726-1 |
| SLES for SAP 15 SP5 | python-tornado6 | 6.3.2-150400.9.9.1 | SUSE-SU-2025:01649-1 |
| SLES for SAP 15 SP5 | salt | 3006.0-150500.4.55.1 | SUSE-SU-2025:02501-1 |
| SLES for SAP 15 SP4 | python-tornado | 4.5.3-150000.3.10.1 | SUSE-SU-2025:01726-1 |
| SLES for SAP 15 SP4 | python-tornado6 | 6.3.2-150400.9.9.1 | SUSE-SU-2025:01649-1 |
| SLES for SAP 15 SP4 | salt | 3006.0-150400.8.80.1 | SUSE-SU-2025:02500-1 |
| SLES for SAP 15 SP3 | python-tornado | 4.5.3-150000.3.10.1 | SUSE-SU-2025:01726-1 |
| SLES for SAP 15 SP3 | salt | 3006.0-150300.53.94.1 | SUSE-SU-2025:02534-1 |
| SLE Micro 6.1 | python-tornado6 | 6.4-slfo.1.1_2.1 | SUSE-SU-2025:20445-1 |
| SLE Micro 6.1 | salt | 3006.0-slfo.1.1_4.1 | SUSE-SU-2025:20487-1 |
| SLE Micro 6.0 | python-tornado6 | 6.4-3.1 | SUSE-SU-2025:20430-1 |
| SLE Micro 6.0 | salt | 3006.0-13.1 | SUSE-SU-2025:20504-1 |
| SLE Micro 5.5 | python-tornado | 4.5.3-150000.3.10.1 | SUSE-SU-2025:01726-1 |
| SLE Micro 5.5 | salt | 3006.0-150500.4.55.1 | SUSE-SU-2025:02501-1 |
| SLE Micro 5.4 | python-tornado | 4.5.3-150000.3.10.1 | SUSE-SU-2025:01726-1 |
| SLE Micro 5.4 | salt | 3006.0-150400.8.80.1 | SUSE-SU-2025:02500-1 |
| SLE Micro 5.3 | python-tornado | 4.5.3-150000.3.10.1 | SUSE-SU-2025:01726-1 |
| SLE Micro 5.3 | salt | 3006.0-150400.8.80.1 | SUSE-SU-2025:02500-1 |
| SLE Micro 5.2 | python-tornado | 4.5.3-150000.3.10.1 | SUSE-SU-2025:01726-1 |
| SLE Micro 5.2 | salt | 3006.0-150300.53.94.1 | SUSE-SU-2025:02534-1 |
| SLE Micro 5.1 | salt | 3006.0-150300.53.94.1 | SUSE-SU-2025:02534-1 |
| SLE HPC 15 SP5 | python-tornado | 4.5.3-150000.3.10.1 | SUSE-SU-2025:01726-1 |
| SLE HPC 15 SP5 | python-tornado6 | 6.3.2-150400.9.9.1 | SUSE-SU-2025:01649-1 |
| SLE HPC 15 SP5 | salt | 3006.0-150500.4.55.1 | SUSE-SU-2025:02501-1 |
| SLE HPC 15 SP4 | python-tornado | 4.5.3-150000.3.10.1 | SUSE-SU-2025:01726-1 |
| SLE HPC 15 SP4 | python-tornado6 | 6.3.2-150400.9.9.1 | SUSE-SU-2025:01649-1 |
| SLE HPC 15 SP4 | salt | 3006.0-150400.8.80.1 | SUSE-SU-2025:02500-1 |
| SLE HPC 15 SP3 | python-tornado | 4.5.3-150000.3.10.1 | SUSE-SU-2025:01726-1 |
| SLE HPC 15 SP3 | salt | 3006.0-150300.53.94.1 | SUSE-SU-2025:02534-1 |
| SUSE Manager Server Module 4.3 | venv-salt-minion | 3006.0-150000.3.78.1 | SUSE-SU-2025:02492-1 |
| SUSE Manager Server 4.3 | python-tornado | 4.5.3-150000.3.10.1 | SUSE-SU-2025:01726-1 |
| SUSE Manager Server 4.3 | salt | 3006.0-150400.8.80.1 | SUSE-SU-2025:02500-1 |
| SUSE Manager Proxy Module 4.3 | venv-salt-minion | 3006.0-150000.3.78.1 | SUSE-SU-2025:02492-1 |
| SUSE Manager Proxy 4.3 | python-tornado | 4.5.3-150000.3.10.1 | SUSE-SU-2025:01726-1 |
| SUSE Manager Proxy 4.3 | salt | 3006.0-150400.8.80.1 | SUSE-SU-2025:02500-1 |
| SUSE Manager Client Tools for SLE Micro 5 | venv-salt-minion | 3006.0-150000.3.78.1 | SUSE-SU-2025:02492-1 |
| SUSE Manager Client Tools for RHEL, Liberty and Clones 9 | venv-salt-minion | 3006.0-1.59.1 | SUSE-SU-2025:02499-1, SUSE-EL-9-CLIENT-TOOLS-2025-2499 |
| SUSE Manager Client Tools 15 | venv-salt-minion | 3006.0-150000.3.78.1 | SUSE-SU-2025:02492-1 |
| SUSE Manager Client Tools 12 | python-tornado | 4.2.1-17.10.1 | SUSE-SU-2025:01732-1 |
| SUSE Manager Client Tools 12 | venv-salt-minion | 3006.0-3.76.2 | SUSE-SU-2025:02491-1 |
| SUSE Enterprise Storage 7.1 | python-tornado | 4.5.3-150000.3.10.1 | SUSE-SU-2025:01726-1 |
| SUSE Enterprise Storage 7.1 | salt | 3006.0-150300.53.94.1 | SUSE-SU-2025:02534-1 |
| SUSE EL-9:Update:Products:SaltBundle:Update | saltbundlepy +1 | 3.11.11-1.32.1 | SUSE-SU-2025:02499-1 |
| SUSE EL-9:Update:Products:SaltBundle:Update | saltbundlepy-cython | 0.29.37-1.12.2 | SUSE-SU-2025:02499-1 |
| SUSE EL-9:Update:Products:SaltBundle:Update | saltbundlepy-jinja2 | 3.1.2-1.12.2 | SUSE-SU-2025:02499-1 |
| SUSE EL-9:Update:Products:SaltBundle:Update | saltbundlepy-lxml | 4.9.4-1.21.1 | SUSE-SU-2025:02499-1 |
| SUSE EL-9:Update:Products:SaltBundle:Update | saltbundlepy-m2crypto | 0.45.1-1.12.1 | SUSE-SU-2025:02499-1 |
| SUSE EL-9:Update:Products:SaltBundle:Update | saltbundlepy-msgpack | 1.0.7-1.14.1 | SUSE-SU-2025:02499-1 |
| SUSE EL-9:Update:Products:SaltBundle:Update | saltbundlepy-ply | 3.11-1.8.1 | SUSE-SU-2025:02499-1 |
| SUSE EL-9:Update:Products:SaltBundle:Update | saltbundlepy-tornado | 6.3.2-1.12.2 | SUSE-SU-2025:02499-1 |
| SUSE EL-9:Update:Products:SaltBundle:Update | saltbundlepy-zypp-plugin | 0.6.5-1.11.1 | SUSE-SU-2025:02499-1 |
| SUSE EL-9:Update:Products:SaltBundle:Update | venv-salt-minion | 3006.0-1.59.1 | SUSE-SU-2025:02499-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-tornado6 | 6.5-1.1 | openSUSE-SU-2025:15153-1 |
| openSUSE Tumbleweed | salt | 3006.0-41.1 | openSUSE-SU-2025:15295-1 |
| openSUSE Leap 15.6 | python-tornado6 | 6.3.2-150400.9.9.1 | SUSE-SU-2025:01649-1 |
| openSUSE Leap 15.6 | salt +1 | 3006.0-150500.4.55.1 | SUSE-SU-2025:02501-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3-tornado +1 | 6.1.0-2.amzn2023.0.5 | ALAS2023-2025-1002 |
| Amazon Linux 2 | python-tornado +1 | 4.2.1-3.amzn2.0.2 | ALAS2-2025-2888 |
| Amazon Linux 2 | python3-tornado +1 | 5.0.2-4.amzn2.0.5 | ALAS2-2025-2889 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-tornado | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | python-tornado | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | python3-tornado | 6.4.2-1.el10_0.1 | ELSA-2025-8135 |
| Oracle Linux 9 | python3-tornado | 6.4.2-2.el9_6.2 | ELSA-2025-8136 |
| Oracle Linux 8 | pcs +1 | 0.10.18-2.0.1.el8_10.5 | ELSA-2025-8254 |
| Oracle Linux 7 | python-tornado +1 | 4.2.1-5.0.1.el7 | ELSA-2025-8664 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | airflow | 2.10.5-r44 | — |
| Wolfi rolling | airflow-3 +3 | 3.0.1-r1 | — |
| Wolfi rolling | dask-kubernetes | 2025.4.3-r1 | — |
| Wolfi rolling | jupyter-base-notebook | 7.4.2-r2 | — |
| Wolfi rolling | jupyter-docker-base +1 | 999.9.9_git20260925-r0 | — |
| Wolfi rolling | kubeflow-pipelines-visualization-server | 2.5.0-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | tornado | < 6.5 | 6.5 | GHSA-7cx3-6m66-7c5m |
Advisories 46
- ALSA-2025:8135 Important: python-tornado security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:8136 Important: python-tornado security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:8254 Important: pcs security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:8323 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8290 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8291 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8279 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8254 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- SUSE-EL-9-CLIENT-TOOLS-2025-2499 Security update 5.0.5 for Multi-Linux Manager Salt Bundle SUSE / openSUSE Security Updates · Jul 24, 2026
- RHSA-2025:8664 Red Hat Security Advisory: python-tornado security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:8226 Red Hat Security Advisory: python-tornado security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:8223 Red Hat Security Advisory: python-tornado security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:8136 Red Hat Security Advisory: python-tornado security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- RHSA-2025:8135 Red Hat Security Advisory: python-tornado security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- USN-7547-1 python-tornado vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- openSUSE-SU-2025:15295-1 python311-salt-3006.0-41.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15153-1 python311-tornado6-6.5-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20504-1 Security update 5.0.5 for Multi-Linux Manager Client Tools, Salt and Salt Bundle SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02500-1 Security update for salt SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02501-1 Security update for salt SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20430-1 Security update for python-tornado6 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02491-1 Security update 5.0.5 for Multi-Linux Manager Salt Bundle SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:01649-2 Security update for python-tornado6 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20487-1 Security update for salt SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20445-1 Security update for python-tornado6 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02499-1 Security update 5.0.5 for Multi-Linux Manager Salt Bundle SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02492-1 Security update 5.0.5 for Multi-Linux Manager Salt Bundle SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:01726-1 Security update for python-tornado SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02534-1 Security update for salt SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02502-1 Security update for salt SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:01726-2 Security update for python-tornado SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-4188-1 python-tornado - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-5938-1 python-tornado - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2025-1143 Red Hat Enterprise Linux (python-tornado): Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Feb 4, 2026
- SUSE-SU-2025:01649-1 Security update for python-tornado6 SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2025:8135 Important: python-tornado security update Rocky Linux Security Advisories · Oct 8, 2025
- RLSA-2025:8136 Important: python-tornado security update Rocky Linux Security Advisories · Oct 7, 2025
- RLSA-2025:8254 Important: pcs security update Rocky Linux Security Advisories · Jul 29, 2025
- ELSA-2025-8664 Important: python-tornado security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 2, 2025
- ELSA-2025-8135 Important: python-tornado security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jun 26, 2025
- ALAS2-2025-2888 Moderate: python-tornado security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jun 12, 2025
- ALAS2-2025-2889 Moderate: python3-tornado security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jun 12, 2025
- ALAS2023-2025-1002 Moderate: python-tornado security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 10, 2025
- SUSE-SU-2025:01732-1 Security update for python-tornado SUSE / openSUSE Security Updates · May 29, 2025
- ELSA-2025-8254 Important: pcs security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 28, 2025
- ELSA-2025-8136 Important: python-tornado security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 26, 2025