CVE-2025-47287High· 7.5▾ TwilightTornado vulnerable to excessive logging caused by malformed multipart form data
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.7%
Last analysed / modified upstream
0.7% → 0.7%
When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous.
All versions of Tornado prior to 6.5 are affected. The vulnerable parser is enabled by default.
Upgrade to Tornado version 6.5. In the meantime, risk can be mitigated by blocking Content-Type: multipart/form-data in a proxy.
tornado < 6.5Upgrade to a patched release:
tornado 6.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115927Medium· 5.3Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
CVE-2026-116577Medium· 5.3Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
CVE-2026-116578Low· 2.1Tornado: Open redirect in RedirectHandler via protocol-relative URLs
CVE-2026-103262High· 7.5Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response
CVE-2026-103263Medium· 5.9Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it
CVE-2026-103261Medium· 5.3Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters