Medium severity5.9NVD Advisory· Published Sep 15, 2026

CVE-2026-91992

Description

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Tornadoweb/Tornadollm-fuzzy
Range: <6.5.7

Patches

Vulnerability mechanics

References

github.com/tornadoweb/tornado/security/advisories/GHSA-pw6j-qg29-8w7fnvd
www.vulncheck.com/advisories/tornado-before-6.5.7-credential-leak-via-handle-reusenvd

News mentions

No linked articles in our index yet.

cvss	0.384
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000