Is CVE-2026-91992 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91992 being exploited in the wild.

How severe is CVE-2026-91992?

Medium severity, with a CVSS score of 5.9, published 15 September 2026.

Which products and versions are affected?

tornado (PyPI) ECOSYSTEM:introduced=0,fixed=6.5.7.

Is there a fix for CVE-2026-91992?

Yes. tornado (PyPI): upgrade to 6.5.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-91992 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-91992?

Check whether you run tornado (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91992: Tornado CurlAsyncHTTPClient credential leak via handle reuse

CVE-2026-91992 · Severity: medium · CVSS 5.9 · Published 2026-09-15

Tornado's HTTP client implementation reuses network connections across requests but fails to clear sensitive authentication state between them. An attacker who can influence multiple requests through the same client instance can steal TLS certificates, proxy credentials, or force requests through unintended network interfaces. This is a serious risk in multi-tenant or proxy-based deployments where credentials should be isolated per-request.

Technologies: tornado (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-91992 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91992 being exploited in the wild.
How severe is CVE-2026-91992?: Medium severity, with a CVSS score of 5.9, published 15 September 2026.
Which products and versions are affected?: tornado (PyPI) ECOSYSTEM:introduced=0,fixed=6.5.7.
Is there a fix for CVE-2026-91992?: Yes. tornado (PyPI): upgrade to 6.5.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91992 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-91992?: Check whether you run tornado (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tornado (PyPI): upgrade to 6.5.7 or later
```
pip install "tornado>=6.5.7"
```

Technical details

CurlAsyncHTTPClient in tornado/curl_httpclient.py pools and reuses pycurl handles for performance, but _curl_setup_request() does not call curl.reset() between requests. Per-request options like SSLCERT, SSLKEY, PROXYUSERPWD, and INTERFACE are set conditionally and lack corresponding unset/clear branches, causing sensitive state from one request to leak into subsequent requests on the same client instance. Attack vectors include: (A) client TLS certificate persistence allowing an attacker's request to present the certificate during TLS handshake to an unintended host, and (B) proxy authentication credentials persisting and being sent to a different proxy. No user interaction or authentication is required; the vulnerability is triggered by issuing multiple HTTP requests through a shared client instance. Tornado 6.5.7 patches this by properly resetting pycurl handles between requests.

Affected products

Tornado Tornado before 6.5.7

Identifiers

CVE-2026-91992
GHSA-pw6j-qg29-8w7f

Timeline

2026-06-08: disclosed: GitHub Security Advisory GHSA-pw6j-qg29-8w7f published
2026-06-08: patched: Fixed in Tornado 6.5.7
2026-09-15: advisory: NVD entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.