diff --git a/pcs.spec b/pcs.spec
index e69117b8a155e4b6463690f0d0bff9b31dde0e1c..49435ae6d6f17ef62403a84b36b621353020cdba 100644
--- a/pcs.spec
+++ b/pcs.spec
@@ -1,6 +1,6 @@
 Name:    pcs
 Version: 0.10.5
-Release: 4
+Release: 5
 License: GPLv2 and BSD-2-Clause and ASL 2.0 and MIT
 URL:     https://github.com/ClusterLabs/pcs
 Summary: Pacemaker Configuration System
@@ -15,7 +15,7 @@ Summary: Pacemaker Configuration System
 %global pcs_snmp_pkg_name  pcs-snmp
 
 %global pyagentx_version 0.4.pcs.2
-%global tornado_version 6.0.3
+%global tornado_version 6.1.0.pcs.2
 %global dacite_version 1.1.0
 %global rubygem_tilt_version 2.0.9
 
@@ -439,6 +439,9 @@ remove_all_tests
 %license pyagentx_LICENSE.txt
 
 %changelog
+* Tue Jul 22 2025 zouzhimin <zouzhimin@kylinos.cn> - 0.10.5-5
+- update tornado to 6.1.0.pcs.2 and fix CVE-2025-47287
+
 * Tue Oct 25 2022 jiangxinyu <jiangxinyu@kylinos.cn> - 0.10.5-4
 - Fix the failure of field matching in test cases
 
diff --git a/tornado-6.0.3.tar.gz b/tornado-6.0.3.tar.gz
deleted file mode 100644
index 1352a3401af5655748e3e8bb0bcedc3c98b73646..0000000000000000000000000000000000000000
Binary files a/tornado-6.0.3.tar.gz and /dev/null differ
diff --git a/tornado-6.1.0.pcs.2.tar.gz b/tornado-6.1.0.pcs.2.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..367c2fc7d9e23f4798c07f11880463d099e3eb17
Binary files /dev/null and b/tornado-6.1.0.pcs.2.tar.gz differ