CVE-2026-91992

EUVD-2026-78664
Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 15.09%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
tornadowebtornado
𝑥
< 6.5.7
CNA
Debian logo
Debian Releases
Debian Product
Codename
python-tornado
bookworm
vulnerable
bookworm (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
no-dsa
trixie (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python-tornado
bionic
Fixed in 4.5.3-1ubuntu0.2+esm4
released
focal
Fixed in 6.0.3+really5.1.1-3ubuntu0.1~esm6
released
jammy
Fixed in 6.1.0-3ubuntu0.1~esm6
released
noble
Fixed in 6.4.0-1ubuntu0.6
released
resolute
Fixed in 6.5.4-0.1ubuntu0.2
released
stonking
Fixed in 6.5.5-5ubuntu1
released
xenial
Fixed in 4.2.1-1ubuntu3.1+esm4
released
Common Weakness Enumeration
References
https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw6j-qg29-8w7f
https://www.vulncheck.com/advisories/tornado-before-6.5.7-credential-leak-via-handle-reuse
https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw6j-qg29-8w7f