Python tornado: Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper… (CVE-2026-91992)
Description
Tornado versions before 6.5.7 contain a vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without properly clearing state. This can lead to leakage of sensitive credentials such as TLS certificates or proxy authentication data across unintended requests. The vulnerability has a medium severity with a CVSS score of 5.9. Multiple specific Tornado package versions are affected. No explicit patch information is provided in the source data.
CVSS v3.1
Score 5.9medium
Affected software
pkg:deb/ubuntu/python-tornado?arch=source&distro=esm-infra-legacy/xenialpkg:deb/ubuntu/python-tornado?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/python-tornado?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/python-tornado?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/python-tornado?arch=source&distro=noblepkg:deb/ubuntu/python-tornado?arch=source&distro=stonkingpkg:deb/ubuntu/python-tornado?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Tornado's CurlAsyncHTTPClient arises because pycurl handles are reused across multiple HTTP requests without proper state clearing. This improper reuse allows sensitive credentials, including TLS certificates and proxy authentication information, to persist and potentially be leaked to unintended requests made through the same client instance. The issue affects Tornado versions prior to 6.5.7 and has been assigned CVE-2026-91992 with a CVSS 3.1 base score of 5.9 (medium severity).
Potential Impact
An attacker able to issue requests through the same Tornado CurlAsyncHTTPClient instance can obtain sensitive credentials that persist across requests, such as TLS certificates or proxy authentication credentials. This could lead to unauthorized access or credential disclosure. There is no indication of impact on integrity or availability, and no known exploits in the wild have been reported.
Mitigation Recommendations
A fix is available in Tornado version 6.5.7 and later. Users should upgrade to Tornado 6.5.7 or newer to remediate this credential leak vulnerability. Since no vendor advisory or patch links were provided, confirm patch availability and upgrade guidance from the official Tornado project or trusted package maintainers.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-91992
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ada44d64d27ba8daa6a5130
Added to database: 10/22/2026, 17:16:06 UTC
Last enriched: 10/22/2026, 17:24:06 UTC
Last updated: 10/22/2026, 17:24:06 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.