https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 14:10:44 +0000 https://cve.radiocsirt.org/vuln/alsa-2025:8135 <p><strong>Affected:</strong> AlmaLinux:10: python3-tornado</p> <p>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.</p> <p>Security Fix(es):</p> <p>* tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:10: python3-tornado</p> <p>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.</p> <p>Security Fix(es):</p> <p>* tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2025:8135 https://cve.radiocsirt.org/vuln/bdu:2025-08361 bdu:2025-08361 https://cve.radiocsirt.org/vuln/bdu:2025-08361 https://cve.radiocsirt.org/vuln/brew-jupyterlab-cve-2025-47287 <p><strong>Affected:</strong> Homebrew: jupyterlab</p> <p>### Summary</p> <p>When Tornado&#39;s ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous.</p> <p>### Affected versions</p> <p>All versions of Tornado prior to 6.5 are affected. The vulnerable parser is enabled by default.</p> <p>### Solution</p> <p>Upgrade to Tornado version 6.5. In the meantime, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.</p> <p><strong>Affected:</strong> Homebrew: jupyterlab</p> <p>### Summary</p> <p>When Tornado&#39;s ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous.</p> <p>### Affected versions</p> <p>All versions of Tornado prior to 6.5 are affected. The vulnerable parser is enabled by default.</p> <p>### Solution</p> <p>Upgrade to Tornado version 6.5. In the meantime, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.</p> https://cve.radiocsirt.org/vuln/brew-jupyterlab-cve-2025-47287 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0760 certfr-2025-avi-0760 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0760 https://cve.radiocsirt.org/vuln/euvd-2026-241685 EUVD-2026-241685 https://cve.radiocsirt.org/vuln/euvd-2026-241685 https://cve.radiocsirt.org/vuln/fkie_cve-2025-47287 <p>Tornado is a Python web framework and asynchronous networking library. When Tornado&#39;s ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.</p> <p>Tornado is a Python web framework and asynchronous networking library. When Tornado&#39;s ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-47287 https://cve.radiocsirt.org/vuln/ghsa-7cx3-6m66-7c5m <p><strong>Affected:</strong> PyPI: tornado</p> <p>### Summary</p> <p>When Tornado&#39;s ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous.</p> <p>### Affected versions</p> <p>All versions of Tornado prior to 6.5 are affected. The vulnerable parser is enabled by default.</p> <p>### Solution</p> <p>Upgrade to Tornado version 6.5. In the meantime, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.</p> <p><strong>Affected:</strong> PyPI: tornado</p> <p>### Summary</p> <p>When Tornado&#39;s ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous.</p> <p>### Affected versions</p> <p>All versions of Tornado prior to 6.5 are affected. The vulnerable parser is enabled by default.</p> <p>### Solution</p> <p>Upgrade to Tornado version 6.5. In the meantime, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.</p> https://cve.radiocsirt.org/vuln/ghsa-7cx3-6m66-7c5m https://cve.radiocsirt.org/vuln/oesa-2025-1554 <p><strong>Affected:</strong> openEuler:24.03-LTS: python-tornado</p> <p>Tornado is an open source version of the scalable, non-blocking web server and tools. Security Fix(es):</p> <p>Tornado is a Python web framework and asynchronous networking library. When Tornado&amp;apos;s ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.(CVE-2025-47287)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS: python-tornado</p> <p>Tornado is an open source version of the scalable, non-blocking web server and tools. Security Fix(es):</p> <p>Tornado is a Python web framework and asynchronous networking library. When Tornado&amp;apos;s ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.(CVE-2025-47287)</p> https://cve.radiocsirt.org/vuln/oesa-2025-1554 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15153-1 <p>python311-tornado6-6.5-1.1 on GA media</p> <p>python311-tornado6-6.5-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15153-1 https://cve.radiocsirt.org/vuln/pysec-2026-1974 <p><strong>Affected:</strong> PyPI: tornado</p> <p>### Summary</p> <p>When Tornado&#39;s ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous.</p> <p>### Affected versions</p> <p>All versions of Tornado prior to 6.5 are affected. The vulnerable parser is enabled by default.</p> <p>### Solution</p> <p>Upgrade to Tornado version 6.5. In the meantime, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.</p> <p><strong>Affected:</strong> PyPI: tornado</p> <p>### Summary</p> <p>When Tornado&#39;s ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous.</p> <p>### Affected versions</p> <p>All versions of Tornado prior to 6.5 are affected. The vulnerable parser is enabled by default.</p> <p>### Solution</p> <p>Upgrade to Tornado version 6.5. In the meantime, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1974 https://cve.radiocsirt.org/vuln/rhsa-2025:8223 <p>tornado: Tornado Multipart Form-Data Denial of Service</p> <p>tornado: Tornado Multipart Form-Data Denial of Service</p> https://cve.radiocsirt.org/vuln/rhsa-2025:8223 https://cve.radiocsirt.org/vuln/suse-el-9-client-tools-2025-2499 <p>Security update 5.0.5 for Multi-Linux Manager Salt Bundle</p> <p>Security update 5.0.5 for Multi-Linux Manager Salt Bundle</p> https://cve.radiocsirt.org/vuln/suse-el-9-client-tools-2025-2499 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-47287 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-tornado, Ubuntu:Pro:18.04:LTS: python-tornado, Ubuntu:Pro:20.04:LTS: python-tornado, Ubuntu:Pro:22.04:LTS: python-tornado, Ubuntu:24.04:LTS: python-tornado, Ubuntu:25.10: python-tornado</p> <p>Tornado is a Python web framework and asynchronous networking library. When Tornado&#39;s ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-tornado, Ubuntu:Pro:18.04:LTS: python-tornado, Ubuntu:Pro:20.04:LTS: python-tornado, Ubuntu:Pro:22.04:LTS: python-tornado, Ubuntu:24.04:LTS: python-tornado, Ubuntu:25.10: python-tornado</p> <p>Tornado is a Python web framework and asynchronous networking library. When Tornado&#39;s ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-47287 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1143 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1143