Overview
CVE-2025-47287 is a high-risk vulnerability that affects the Tornado Python web framework and asynchronous networking library. The flaw lies in Tornado’s multipart/form-data parser, which can be manipulated by remote attackers to generate an extraordinarily high volume of logs, leading to a Denial-of-Service (DoS) attack. All versions of Tornado prior to 6.5.0 are susceptible to this vulnerability.
Vulnerability Summary
CVE ID: CVE-2025-47287
Severity: High (CVSS: 7.5)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage
Affected Products
A new way to communicate
Ameeba Chat is built on encrypted identity, not personal profiles.
Message, call, share files, and coordinate with identities kept separate.
- • Encrypted identity
- • Ameeba Chat authenticates access
- • Aliases and categories
- • End-to-end encrypted chat, calls, and files
- • Secure notes for sensitive information
Private communication, rethought.
Product | Affected Versions
Tornado Python Web Framework | All versions prior to 6.5.0
How the Exploit Works
The vulnerability stems from a weakness in Tornado’s multipart/form-data parser. When the parser encounters certain errors, it logs a warning but continues to parse the remaining data. This behavior can be exploited by remote attackers who can send malformed multipart/form-data requests at a high frequency to generate an enormous volume of logs, leading to a DoS attack. The impact of the attack is compounded by the fact that the logging subsystem is synchronous.
Conceptual Example Code
The following HTTP request could potentially exploit the vulnerability:
POST /vulnerable/endpoint HTTP/1.1
Host: target.example.com
Content-Type: multipart/form-data
--boundary
Content-Disposition: form-data; name="file"; filename="malicious.txt"
Content-Type: text/plain
{ "malicious_payload": "..." }
--boundary--In this example, the attacker sends a malformed multipart/form-data request with a malicious payload to the vulnerable endpoint. The server, upon receiving the request, logs a warning and continues to parse the remaining data, causing the log files to grow exponentially and eventually leading to a DoS attack.