Ubuntu 7547-1: Moderate Risk - Tornado Resource Exhaustion Threat

ubuntu

June 2, 2025

Tornado could be made to consume excessive resources when processing specially crafted HTTP requests.

Summary

Tornado could be made to consume excessive resources when processing

specially crafted HTTP requests.

Software Description:

- python-tornado: scalable, non-blocking web server and tools

Details:

It was discovered that Tornado inefficiently handled requests when

parsing certain form data. An attacker could possibly use this issue to

increase resource utilization leading to a denial of service. This issue

was only addressed in Ubuntu 24.04 LTS and Ubuntu 22.04 LTS.

(CVE-2025-47287)

Topics Covered

security advisory denial of service vulnerability ubuntu resource exhaustion python-tornado

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.04
  python3-tornado                 6.4.2-1ubuntu0.25.04.1

Ubuntu 24.10
  python3-tornado                 6.4.1-2ubuntu0.2

Ubuntu 24.04 LTS
  python3-tornado                 6.4.0-1ubuntu0.2

Ubuntu 22.04 LTS
  python3-tornado                 6.1.0-3ubuntu0.1~esm2
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.