Executive brief
Tornado, a popular Python web framework and networking library, contains a vulnerability in its Curl-based HTTP client. When the client reuses internal handles to make multiple requests, it may fail to clear sensitive information like TLS certificates or proxy passwords from the previous session. This could result in private credentials being accidentally sent to an unintended third-party server or proxy.
Technical details
The CurlAsyncHTTPClient in Tornado fails to call curl.reset() or provide exhaustive clearing branches when reusing pycurl handles across different requests. Specifically, sensitive options such as SSLCERT, SSLKEY, and PROXYUSERPWD are set for a request but not unset if the subsequent request using the same handle does not require them. This leads to a CWE-200 (Information Exposure) scenario where a reused handle presents the previous request's client certificate or proxy credentials to a new, potentially untrusted destination. The vulnerability is present in tornado/curl_httpclient.py and is fixed in version 6.5.7 by ensuring handle state is properly reset.
Affected products
- tornadoweb tornado <= 6.5.6
Timeline
- 2026-06-08: disclosed
- 2026-06-15: advisory
- 2026-06-15: patched: Version 6.5.7 released