CVE-2026-91992

A flaw was found in Tornado's CurlAsyncHTTPClient. This vulnerability occurs because pycurl handles are reused across requests without proper state clearing. A remote attacker can exploit this by issuing requests through the same client instance, leading to the unintended persistence of sensitive...

CVE-2024-58384

A flaw was found in Tornado's CurlAsyncHTTPClient component. This vulnerability, known as CRLF Carriage Return Line Feed injection, occurs because the client fails to properly reject carriage return and line feed characters in HTTP request headers. A remote attacker can exploit this by injecting...

EUVD-2026-78664

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy...

EUVD-2024-55766

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests...

SUSE-SU-2026:3155-1 Security update for python-tornado6

This update for python-tornado6 fixes the following issue - GHSA-pw6j-qg29-8w7f: CurlAsyncHTTPClient leaks per-request credentials on handle reuse bsc1269012...

ROS-20241112-04

Vulnerability of http requests of CurlAsyncHTTPClient component of Tornado asynchronous network library is related to improper neutralization of CRLF sequences. Exploitation of the vulnerability could allow an attacker acting remotely to inject arbitrary headers into a request or cause an...

Tornado has a CRLF injection in CurlAsyncHTTPClient headers

Summary Tornado’s curlhttpclient.CurlAsyncHTTPClient class is vulnerable to CRLF carriage return/line feed injection in the request headers. Details When an HTTP request is sent using CurlAsyncHTTPClient, Tornado does not reject carriage return \r or line feed \n characters in the request headers...