Vulnerabilities affecting this package (1)
| Vulnerability |
Summary |
Fixed by |
VCID-62bx-a5uf-j3b4
Aliases:
CVE-2025-47287
GHSA-7cx3-6m66-7c5m
|
Tornado vulnerable to excessive logging caused by malformed multipart form data
### Summary
When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous.
### Affected versions
All versions of Tornado prior to 6.5 are affected. The vulnerable parser is enabled by default.
### Solution
Upgrade to Tornado version 6.5. In the meantime, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.
|
There are no reported fixed by versions.
|
Vulnerabilities fixed by this package (0)
| Vulnerability |
Summary |
Aliases |
|
This package is not known to fix vulnerabilities.
|