CVE-2026-91992

NameCVE-2026-91992
DescriptionTornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1148323

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python-tornado (PTS)bookworm, bookworm (security)6.2.0-3+deb12u4vulnerable
trixie (security), trixie6.4.2-3+deb13u2vulnerable
forky, sid6.5.5-5vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python-tornadosource(unstable)(unfixed)1148323

Notes

[trixie] - python-tornado <no-dsa> (Minor issue)
https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw6j-qg29-8w7f
Search for package or bug name: Reporting problems