Description

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.

Remediation

References

CVE-2026-91992

Related Vulnerabilities

TYPO3 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-12748)

WordPress Plugin WP Maps-Display Google Maps Perfectly with Ease Cross-Site Request Forgery (4.2.3)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2009-4298)

MySQL CVE-2022-21356 Vulnerability (CVE-2022-21356)

OpenSSL Improper Check for Unusual or Exceptional Conditions Vulnerability (CVE-2025-69420)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-200 CVE-2026-91992