7.5

CVE-2025-47287: debian debian_linux

CVSS: 7.5v3.1HighAnalyzed
AliasesMGASA-2025-0282SUSE-SU-2025:01649-1SUSE-SU-2025:01649-2
Published 15-05-2025Last modified 29-05-2025
Open JSON

Vulnerability summary

CVE-2025-47287 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 53.9% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.74%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 17 · Related 20
OPENSUSE-SU-2025:15295-1RHSA-2025:8254RHSA-2025:8279RHSA-2025:8290RHSA-2025:8291RHSA-2025:8323

Timeline

  1. 15-05-2025
    PublishedVulnerability first disclosed.
  2. 29-05-2025
    Last modifiedVulnerability information updated.

Description

Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

0.74%

Chance of exploitation in the next 30 days

Percentile

54%

Versus all other CVEs

30-day change

0.00 pp

From 0.74% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.74%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse32 products
  • python-tornado6&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 6.3.2-150400.9.9.1
  • python-tornado6&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 6.3.2-150400.9.9.1
  • python-tornado6&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 6.3.2-150400.9.9.1
  • python-tornado6&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 6.3.2-150400.9.9.1
  • python-tornado6&distro=SUSE Linux Enterprise Module for Python 3 15 SP6< 6.3.2-150400.9.9.1
Chainguard12 products
  • airflow< 2.10.5-r44
  • airflow-3< 3.0.1-r1
  • airflow-3-bitnami-compat< 3.0.1-r1
  • airflow-3-compat< 3.0.1-r1
  • airflow-3-iamguarded-compat< 3.0.1-r1
Wolfi11 products
  • airflow< 2.10.5-r44
  • airflow-3< 3.0.1-r1
  • airflow-3-bitnami-compat< 3.0.1-r1
  • airflow-3-compat< 3.0.1-r1
  • airflow-3-iamguarded-compat< 3.0.1-r1
Redhat6 products
  • python-tornado< 0:6.4.2-1.el10_0.1 | < 0:6.4.2-2.el9_6.2 | < 0:6.4.2-1.el9_4.1 | < 0:6.4.2-1.el9_2.1 | < 0:4.2.1-5.el7_9.1
  • python-tornado-debuginfo< 0:4.2.1-5.el7_9.1
  • python-tornado-debugsource< 0:6.4.2-1.el10_0.1 | < 0:6.4.2-2.el9_6.2 | < 0:6.4.2-1.el9_4.1 | < 0:6.4.2-1.el9_2.1
  • python-tornado-doc< 0:4.2.1-5.el7_9.1
  • python3-tornado< 0:6.4.2-1.el10_0.1 | < 0:6.4.2-2.el9_6.2 | < 0:6.4.2-1.el9_4.1 | < 0:6.4.2-1.el9_2.1
Debian2 products
  • python-tornado< 6.4.2-2 | < 6.2.0-3+deb12u2 | < 6.1.0-1+deb11u2
  • debian_linuxEOL11.0
Opensuse2 products
  • python-tornado6&distro=openSUSE Leap 15.6< 6.3.2-150400.9.9.1
  • python-tornado6&distro=openSUSE Tumbleweed< 6.5-1.1
Mageia1 product
  • python-tornado< 6.3.2-1.2.mga9
PyPI1 product
  • tornado< 6.5
Tornadoweb1 product
Ubuntu1 product
  • python-tornadoAll versions (No fix recorded) | < 6.4.2-2 | < 6.1.0-3ubuntu0.1~esm2 | < 6.4.0-1ubuntu0.2

10 vendors · 69 products

References

36 links
Show all 36 references