Overview
CVE-2025-47287 is a high-risk vulnerability that affects the Tornado Python web framework and asynchronous networking library. The flaw lies in Tornado’s multipart/form-data parser, which can be manipulated by remote attackers to generate an extraordinarily high volume of logs, leading to a Denial-of-Service (DoS) attack. All versions of Tornado prior to 6.5.0 are susceptible to this vulnerability.
Vulnerability Summary
CVE ID: CVE-2025-47287
Severity: High (CVSS: 7.5)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Tornado Python Web Framework | All versions prior to 6.5.0
How the Exploit Works
The vulnerability stems from a weakness in Tornado’s multipart/form-data parser. When the parser encounters certain errors, it logs a warning but continues to parse the remaining data. This behavior can be exploited by remote attackers who can send malformed multipart/form-data requests at a high frequency to generate an enormous volume of logs, leading to a DoS attack. The impact of the attack is compounded by the fact that the logging subsystem is synchronous.
Conceptual Example Code
The following HTTP request could potentially exploit the vulnerability:
POST /vulnerable/endpoint HTTP/1.1
Host: target.example.com
Content-Type: multipart/form-data
--boundary
Content-Disposition: form-data; name="file"; filename="malicious.txt"
Content-Type: text/plain
{ "malicious_payload": "..." }
--boundary--In this example, the attacker sends a malformed multipart/form-data request with a malicious payload to the vulnerable endpoint. The server, upon receiving the request, logs a warning and continues to parse the remaining data, causing the log files to grow exponentially and eventually leading to a DoS attack.
