Debian/python-tornado: unknown

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive crede

Action: No fix published. Pin and monitor.

Affected

introduced	fixed	last affected
0	-	-

Fixed versions

No fixed version in the source.

Sources

osv: DEBIAN-CVE-2026-91992#Debian:13/python-tornado
https://security-tracker.debian.org/tracker/CVE-2026-91992

published 2026-09-15T16:17:58.447Z · modified 2026-10-01T03:03:55.446436907Z · JSON