CVE-2026-91992

Tornado versions before 6.5.7 reuse pycurl handles across requests in CurlAsyncHTTPClient without properly clearing per-request state. An attacker who can cause the application to issue an attacker-influenced request through the same shared client instance can inherit TLS client certificates or proxy authentication configured for earlier requests. This leaks sensitive credentials to destinations that were never intended to receive them, for example routing traffic with private client certs through an attacker-controlled or untrusted proxy. Applications are affected only if they opt into the curl-based HTTP client and share a single client instance across requests with different trust levels. No public proof-of-concept exists and the flaw is not in CISA's KEV catalog, so exploitation is presumed absent at this time.

What to do: Upgrade Tornado to 6.5.7 or later, which clears handle state between requests. If you cannot upgrade, switch to the default SimpleAsyncHTTPClient or ensure a single CurlAsyncHTTPClient instance is never shared across requests targeting different trust domains. Review outbound request logs and proxy configurations for evidence of client certificates or proxy credentials being sent to unintended destinations.