CVE-2026-91992

A flaw was found in Tornado's CurlAsyncHTTPClient. This vulnerability occurs because pycurl handles are reused across requests without proper state clearing. A remote attacker can exploit this by issuing requests through the same client instance, leading to the unintended persistence of sensitive credentials such as TLS certificates or proxy authentication across subsequent requests. This could result in information disclosure.

A Moderate impact credential leak vulnerability exists in Tornado's CurlAsyncHTTPClient. This flaw allows sensitive credentials, such as TLS certificates or proxy authentication, to persist across unintended requests when pycurl handles are reused without proper state clearing within the same client instance.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.