CVE-2025-47287

Name of the Vulnerable Software and Affected Versions: Tornado versions prior to 6.5.0

Description: The issue allows remote attackers to generate a high volume of logs, constituting a denial-of-service (DoS) attack, by exploiting Tornado's multipart/form-data parser when it encounters certain errors. The logging subsystem being synchronous compounds this DoS. The vulnerable parser is enabled by default.

Recommendations: For versions prior to 6.5.0, upgrade to Tornado version 6.5.0 to receive a patch. As a temporary workaround, consider blocking Content-Type: multipart/form-data in a proxy to mitigate the risk.