{
  "cveId": "CVE-2026-91992",
  "url": "https://patchblox.com/security/cve/CVE-2026-91992",
  "summary": "CVE-2026-91992 is fixed in 2 products on 1 platform, first by python3-tornado 6.5.4-0.1ubuntu0.2, released October 1, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "python3-tornado: Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused...",
  "description": "Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.",
  "published": "2026-09-15T09:17:00Z",
  "severity": "Medium",
  "epss": 0.00239,
  "epssPercentile": 0.15114,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "python-tornado",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "4.5.3-1ubuntu0.2\u002Besm4",
      "fix": "python-tornado 4.5.3-1ubuntu0.2\u002Besm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-python-tornado-4.5.3-1ubuntu0.2-esm4",
      "released": "2026-10-24T13:26:02Z"
    },
    {
      "platform": "linux",
      "product": "python3-tornado",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "4.5.3-1ubuntu0.2\u002Besm4",
      "fix": "python3-tornado 4.5.3-1ubuntu0.2\u002Besm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-python3-tornado-4.5.3-1ubuntu0.2-esm4",
      "released": "2026-10-24T13:26:02Z"
    },
    {
      "platform": "linux",
      "product": "python3-tornado",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "6.1.0-3ubuntu0.1~esm6",
      "fix": "python3-tornado 6.1.0-3ubuntu0.1~esm6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-python3-tornado-6.1.0-3ubuntu0.1-esm6",
      "released": "2026-10-24T13:26:08Z"
    },
    {
      "platform": "linux",
      "product": "python3-tornado",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "6.4.0-1ubuntu0.6",
      "fix": "python3-tornado 6.4.0-1ubuntu0.6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-python3-tornado-6.4.0-1ubuntu0.6",
      "released": "2026-10-24T13:26:11Z"
    },
    {
      "platform": "linux",
      "product": "python3-tornado",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "6.5.4-0.1ubuntu0.2",
      "fix": "python3-tornado 6.5.4-0.1ubuntu0.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-python3-tornado-6.5.4-0.1ubuntu0.2",
      "released": "2026-10-01T04:17:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}