HighFix available
python-tornado — security advisory
Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.
- Products
- python-tornado
- Affected versions
- 4.2.1-1ubuntu2, 4.2.1-1ubuntu3, 4.2.1-1ubuntu3.1, 4.2.1-1ubuntu3.1+esm1, 4.2.1-1ubuntu3.1+esm2, 4.2.1-1ubuntu3.1+esm3, 4.5.1-2.1~build2, 4.5.2-1, 4.5.3-1, 4.5.3-1ubuntu0.1, 4.5.3-1ubuntu0.2, 4.5.3-1ubuntu0.2+esm1, 4.5.3-1ubuntu0.2+esm2, 4.5.3-1ubuntu0.2+esm3, 6.1.0-1build1, 6.1.0-2, 6.1.0-3, 6.1.0-3build1, 6.1.0-3ubuntu0.1~esm1, 6.1.0-3ubuntu0.1~esm2, 6.1.0-3ubuntu0.1~esm4, 6.1.0-3ubuntu0.1~esm5, 6.3.2-1, 6.4.0-0ubuntu1, 6.4.0-1, 6.4.0-1build1, 6.4.0-1ubuntu0.1, 6.4.0-1ubuntu0.2, 6.4.0-1ubuntu0.4, 6.4.0-1ubuntu0.5, 6.4.2-3, 6.5.2-3, 6.5.4-0.1, 6.5.4-0.1ubuntu0.1
- Fixed versions
- 4.2.1-1ubuntu3.1+esm4, 4.5.3-1ubuntu0.2+esm4, 6.1.0-3ubuntu0.1~esm6, 6.4.0-1ubuntu0.6, 6.5.4-0.1ubuntu0.2
- CVEs
- CVE-2026-91992
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 20:07 UTC · Revision 1
Source evidence
Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.
osv:UBUNTU-CVE-2026-91992
python-tornado
Fixed versions: 4.2.1-1ubuntu3.1+esm4
python-tornado
Fixed versions: 4.5.3-1ubuntu0.2+esm4
python-tornado
Fixed versions: 6.1.0-3ubuntu0.1~esm6
python-tornado
Fixed versions: 6.4.0-1ubuntu0.6
python-tornado
Fixed versions: 6.5.4-0.1ubuntu0.2
Complete source record
{
"id": "5cf01c259da52f7c5818494c7816fd56ad40d1b15e675cee092fd83a46904d3f",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-91992",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-91992",
"summary": "Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.",
"evidence": "osv:UBUNTU-CVE-2026-91992",
"products": [
{
"name": {
"value": "python-tornado",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.2.1-1ubuntu3.1+esm4",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "4.2.1-1ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "4.2.1-1ubuntu3",
"evidence": "/affected/0/versions"
},
{
"value": "4.2.1-1ubuntu3.1",
"evidence": "/affected/0/versions"
},
{
"value": "4.2.1-1ubuntu3.1+esm1",
"evidence": "/affected/0/versions"
},
{
"value": "4.2.1-1ubuntu3.1+esm2",
"evidence": "/affected/0/versions"
},
{
"value": "4.2.1-1ubuntu3.1+esm3",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "python-tornado",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.5.3-1ubuntu0.2+esm4",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "4.5.1-2.1~build2",
"evidence": "/affected/1/versions"
},
{
"value": "4.5.2-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.5.3-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.5.3-1ubuntu0.1",
"evidence": "/affected/1/versions"
},
{
"value": "4.5.3-1ubuntu0.2",
"evidence": "/affected/1/versions"
},
{
"value": "4.5.3-1ubuntu0.2+esm1",
"evidence": "/affected/1/versions"
},
{
"value": "4.5.3-1ubuntu0.2+esm2",
"evidence": "/affected/1/versions"
},
{
"value": "4.5.3-1ubuntu0.2+esm3",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "python-tornado",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.1.0-3ubuntu0.1~esm6",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "6.1.0-1build1",
"evidence": "/affected/2/versions"
},
{
"value": "6.1.0-2",
"evidence": "/affected/2/versions"
},
{
"value": "6.1.0-3",
"evidence": "/affected/2/versions"
},
{
"value": "6.1.0-3build1",
"evidence": "/affected/2/versions"
},
{
"value": "6.1.0-3ubuntu0.1~esm1",
"evidence": "/affected/2/versions"
},
{
"value": "6.1.0-3ubuntu0.1~esm2",
"evidence": "/affected/2/versions"
},
{
"value": "6.1.0-3ubuntu0.1~esm4",
"evidence": "/affected/2/versions"
},
{
"value": "6.1.0-3ubuntu0.1~esm5",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "python-tornado",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.4.0-1ubuntu0.6",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": [
{
"value": "6.3.2-1",
"evidence": "/affected/3/versions"
},
{
"value": "6.4.0-0ubuntu1",
"evidence": "/affected/3/versions"
},
{
"value": "6.4.0-1",
"evidence": "/affected/3/versions"
},
{
"value": "6.4.0-1build1",
"evidence": "/affected/3/versions"
},
{
"value": "6.4.0-1ubuntu0.1",
"evidence": "/affected/3/versions"
},
{
"value": "6.4.0-1ubuntu0.2",
"evidence": "/affected/3/versions"
},
{
"value": "6.4.0-1ubuntu0.4",
"evidence": "/affected/3/versions"
},
{
"value": "6.4.0-1ubuntu0.5",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "python-tornado",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.5.4-0.1ubuntu0.2",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": [
{
"value": "6.4.2-3",
"evidence": "/affected/4/versions"
},
{
"value": "6.5.2-3",
"evidence": "/affected/4/versions"
},
{
"value": "6.5.4-0.1",
"evidence": "/affected/4/versions"
},
{
"value": "6.5.4-0.1ubuntu0.1",
"evidence": "/affected/4/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2026-91992",
"aliases": [
"UBUNTU-CVE-2026-91992"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.2.1-1ubuntu3.1+esm4"
}
]
}
],
"package": {
"name": "python-tornado",
"purl": "pkg:deb/ubuntu/python-tornado?arch=source&distro=esm-infra-legacy%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"4.2.1-1ubuntu2",
"4.2.1-1ubuntu3",
"4.2.1-1ubuntu3.1",
"4.2.1-1ubuntu3.1+esm1",
"4.2.1-1ubuntu3.1+esm2",
"4.2.1-1ubuntu3.1+esm3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-91992.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python-tornado",
"binary_version": "4.2.1-1ubuntu3.1+esm4"
},
{
"binary_name": "python3-tornado",
"binary_version": "4.2.1-1ubuntu3.1+esm4"
}
],
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.5.3-1ubuntu0.2+esm4"
}
]
}
],
"package": {
"name": "python-tornado",
"purl": "pkg:deb/ubuntu/python-tornado?arch=source&distro=esm-apps%2Fbionic",
"ecosystem": "Ubuntu:Pro:18.04:LTS"
},
"versions": [
"4.5.1-2.1~build2",
"4.5.2-1",
"4.5.3-1",
"4.5.3-1ubuntu0.1",
"4.5.3-1ubuntu0.2",
"4.5.3-1ubuntu0.2+esm1",
"4.5.3-1ubuntu0.2+esm2",
"4.5.3-1ubuntu0.2+esm3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-91992.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python-tornado",
"binary_version": "4.5.3-1ubuntu0.2+esm4"
},
{
"binary_name": "python3-tornado",
"binary_version": "4.5.3-1ubuntu0.2+esm4"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.1.0-3ubuntu0.1~esm6"
}
]
}
],
"package": {
"name": "python-tornado",
"purl": "pkg:deb/ubuntu/python-tornado?arch=source&distro=esm-apps%2Fjammy",
"ecosystem": "Ubuntu:Pro:22.04:LTS"
},
"versions": [
"6.1.0-1build1",
"6.1.0-2",
"6.1.0-3",
"6.1.0-3build1",
"6.1.0-3ubuntu0.1~esm1",
"6.1.0-3ubuntu0.1~esm2",
"6.1.0-3ubuntu0.1~esm4",
"6.1.0-3ubuntu0.1~esm5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-91992.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-tornado",
"binary_version": "6.1.0-3ubuntu0.1~esm6"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.4.0-1ubuntu0.6"
}
]
}
],
"package": {
"name": "python-tornado",
"purl": "pkg:deb/ubuntu/python-tornado?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"6.3.2-1",
"6.4.0-0ubuntu1",
"6.4.0-1",
"6.4.0-1build1",
"6.4.0-1ubuntu0.1",
"6.4.0-1ubuntu0.2",
"6.4.0-1ubuntu0.4",
"6.4.0-1ubuntu0.5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-91992.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-tornado",
"binary_version": "6.4.0-1ubuntu0.6"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.5.4-0.1ubuntu0.2"
}
]
}
],
"package": {
"name": "python-tornado",
"purl": "pkg:deb/ubuntu/python-tornado?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"6.4.2-3",
"6.5.2-3",
"6.5.4-0.1",
"6.5.4-0.1ubuntu0.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-91992.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-tornado",
"binary_version": "6.5.4-0.1ubuntu0.2"
}
],
"availability": "No subscription required"
}
}
],
"modified": "2026-10-22T23:20:52.994305868Z",
"provider": "osv",
"upstream": [
"CVE-2026-91992"
],
"references": [
"https://ubuntu.com/security/CVE-2026-91992",
"https://www.cve.org/CVERecord?id=CVE-2026-91992",
"https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw6j-qg29-8w7f",
"https://ubuntu.com/security/notices/USN-8952-1"
]
},
"related_cves": [
{
"value": "CVE-2026-91992",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/1/score"
},
"source_id": "core-osv",
"document_id": 410138,
"published_at": "2026-09-15T16:17:00+00:00"
}