p PatchFirst

CVE-2026-91992

CVE-2026-91992 · Tornado before 6.5.7 Credential Leak via Handle Reuse

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.

CVSS 8.2 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • tornado

    Versions
    • ≥ 0, < 6.5.7: Affected (semver)
    • 6.5.7: Not affected (semver)

    Update to 6.5.7

  • python-tornado Debian:12

    Versions
    • 6.2.0-3
    • 6.2.0-3+deb12u1
    • 6.2.0-3+deb12u2
    • 6.2.0-3+deb12u3
    • 6.2.0-3+deb12u4
    • 6.3.2-1
    • 6.4.0-1
    • 6.4.0-2
    • 6.4.1-1
    • 6.4.1-2
    • 6.4.1-3
    • 6.4.2-1
    • 6.4.2-2
    • 6.4.2-3
    • 6.5.2-1
    • 6.5.2-2
    • 6.5.2-3
    • 6.5.4-0.1
    • 6.5.4-1
    • 6.5.5-1
    • 6.5.5-2
    • 6.5.5-3
    • 6.5.5-4
    • 6.5.5-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-tornado Debian:13

    Versions
    • 6.4.2-3
    • 6.4.2-3+deb13u1
    • 6.4.2-3+deb13u2
    • 6.5.2-1
    • 6.5.2-2
    • 6.5.2-3
    • 6.5.4-0.1
    • 6.5.4-1
    • 6.5.5-1
    • 6.5.5-2
    • 6.5.5-3
    • 6.5.5-4
    • 6.5.5-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-tornado Debian:14

    Versions
    • 6.4.2-3
    • 6.5.2-1
    • 6.5.2-2
    • 6.5.2-3
    • 6.5.4-0.1
    • 6.5.4-1
    • 6.5.5-1
    • 6.5.5-2
    • 6.5.5-3
    • 6.5.5-4
    • 6.5.5-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tornado PyPI

    Versions
    • 0.2
    • 1.0
    • 1.1
    • 1.1.1
    • 1.2
    • 1.2.1
    • 2.0
    • 2.1
    • 2.1.1
    • 2.2
    • 2.2.1
    • 2.3
    • 2.4
    • 2.4.1
    • 3.0
    • 3.0.1
    • 3.0.2
    • 3.1
    • 3.1.1
    • 3.2
    • 3.2.1
    • 3.2.2
    • 4.0
    • 4.0.1
    • 4.0.2
    • 4.1
    • 4.1b2
    • 4.2
    • 4.2.1
    • 4.2b1
    • 4.3
    • 4.3b1
    • 4.3b2
    • 4.4
    • 4.4.1
    • 4.4.2
    • 4.4.3
    • 4.4b1
    • 4.5
    • 4.5.1
    • 4.5.2
    • 4.5.3
    • 4.5b1
    • 4.5b2
    • 5.0
    • 5.0.1
    • 5.0.2
    • 5.0a1
    • 5.0b1
    • 5.1
    • 5.1.1
    • 5.1b1
    • 6.0
    • 6.0.1
    • 6.0.2
    • 6.0.3
    • 6.0.4
    • 6.0a1
    • 6.0b1
    • 6.1
    • 6.1b1
    • 6.1b2
    • 6.2
    • 6.2b1
    • 6.2b2
    • 6.3
    • 6.3.1
    • 6.3.2
    • 6.3.3
    • 6.3b1
    • 6.4
    • 6.4.1
    • 6.4.2
    • 6.4b1
    • 6.5
    • 6.5.1
    • 6.5.2
    • 6.5.3
    • 6.5.4
    • 6.5.5
    • 6.5.6
    • 6.5b1
    Affected ranges
    • ECOSYSTEM: < 6.5.7

    Update to 6.5.7

  • python-tornado Ubuntu:Pro:16.04:LTS

    Versions
    • 4.2.1-1ubuntu2
    • 4.2.1-1ubuntu3
    • 4.2.1-1ubuntu3.1
    • 4.2.1-1ubuntu3.1+esm1
    • 4.2.1-1ubuntu3.1+esm2
    • 4.2.1-1ubuntu3.1+esm3
    Affected ranges
    • ECOSYSTEM: < 4.2.1-1ubuntu3.1+esm4

    Update to 4.2.1-1ubuntu3.1+esm4

  • python-tornado Ubuntu:Pro:18.04:LTS

    Versions
    • 4.5.1-2.1~build2
    • 4.5.2-1
    • 4.5.3-1
    • 4.5.3-1ubuntu0.1
    • 4.5.3-1ubuntu0.2
    • 4.5.3-1ubuntu0.2+esm1
    • 4.5.3-1ubuntu0.2+esm2
    • 4.5.3-1ubuntu0.2+esm3
    Affected ranges
    • ECOSYSTEM: < 4.5.3-1ubuntu0.2+esm4

    Update to 4.5.3-1ubuntu0.2+esm4

  • python-tornado Ubuntu:Pro:22.04:LTS

    Versions
    • 6.1.0-1build1
    • 6.1.0-2
    • 6.1.0-3
    • 6.1.0-3build1
    • 6.1.0-3ubuntu0.1~esm1
    • 6.1.0-3ubuntu0.1~esm2
    • 6.1.0-3ubuntu0.1~esm4
    • 6.1.0-3ubuntu0.1~esm5
    Affected ranges
    • ECOSYSTEM: < 6.1.0-3ubuntu0.1~esm6

    Update to 6.1.0-3ubuntu0.1~esm6

  • python-tornado Ubuntu:24.04:LTS

    Versions
    • 6.3.2-1
    • 6.4.0-0ubuntu1
    • 6.4.0-1
    • 6.4.0-1build1
    • 6.4.0-1ubuntu0.1
    • 6.4.0-1ubuntu0.2
    • 6.4.0-1ubuntu0.4
    • 6.4.0-1ubuntu0.5
    Affected ranges
    • ECOSYSTEM: < 6.4.0-1ubuntu0.6

    Update to 6.4.0-1ubuntu0.6

  • python-tornado Ubuntu:26.04:LTS

    Versions
    • 6.4.2-3
    • 6.5.2-3
    • 6.5.4-0.1
    • 6.5.4-0.1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 6.5.4-0.1ubuntu0.2

    Update to 6.5.4-0.1ubuntu0.2

Original sources

Check your server →