CVE-2026-91992

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy...

CVE-2026-91992

A flaw was found in Tornado's CurlAsyncHTTPClient. This vulnerability occurs because pycurl handles are reused across requests without proper state clearing. A remote attacker can exploit this by issuing requests through the same client instance, leading to the unintended persistence of sensitive...

EUVD-2026-78664

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy...

CVE-2026-91992 Tornado before 6.5.7 Credential Leak via Handle Reuse

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy...

CVE-2026-91992

Tornado (Python async web framework) versions before 6.5.7 contain a credential leak in CurlAsyncHTTPClient caused by pycurl handles being reused across requests without proper state clearing. A remote attacker can issue requests through the same client instance, causing TLS certificates or proxy...

Linux Distros Unpatched Vulnerability : CVE-2026-91992

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state...

PT-2026-92106

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.5.7 Description A credential leak exists in CurlAsyncHTTPClient because pycurl handles are reused across requests without properly clearing their state. This allows sensitive information set in one request to persis...