{"vulnerability": "ghsa-pw6j-qg29-8w7f", "sightings": [{"uuid": "69df230c-25cd-4a25-be5a-76862fcdf8b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-pw6j-qg29-8w7f", "type": "seen", "source": "https://gist.github.com/alon710/43bcbcd716ebc4457fa6fbcb1b087336", "content": "# GHSA-PW6J-QG29-8W7F: GHSA-pw6j-qg29-8w7f: State Persistence and Sensitive Credential Leakage in Tornado CurlAsyncHTTPClient\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-06-15\n> **Full Report:** https://cvereports.com/reports/GHSA-PW6J-QG29-8W7F\n\n## Summary\nA state persistence vulnerability exists in Tornado's CurlAsyncHTTPClient component where pooled pycurl.Curl handles are reused across asynchronous requests without a complete state reset. Consequently, sensitive per-request configurations, such as client TLS certificates or proxy basic authentication credentials, persist on the shared handle. This behavior leads to subsequent requests leaking these credentials to unauthorized remote servers.\n\n## TL;DR\nTornado's CurlAsyncHTTPClient reuses pycurl handles without resetting configuration state, leading to client certificate and proxy credential leakage to unintended destinations.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200, CWE-672\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: High (AC:H)\n- **CVSS Score**: 5.9 (Medium)\n- **Exploit Status**: PoC (Proof of Concept) Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Tornado Web Framework (CurlAsyncHTTPClient)\n- **tornado**: <= 6.5.6 (Fixed in: `6.5.7`)\n\n## Mitigation\n\n- Upgrade Tornado dependency to version 6.5.7 or later.\n- Replace CurlAsyncHTTPClient with the native SimpleAsyncHTTPClient backend if custom proxy or mTLS features are not required.\n- Isolate client instances by security context to prevent high-privilege handles from being reused for public outbound requests.\n\n**Remediation Steps:**\n1. Identify all instances of CurlAsyncHTTPClient configuration in the codebase.\n2. Update requirements.txt, setup.py, or Pipfile configurations to enforce tornado>=6.5.7.\n3. Run the provided test suite to verify that client certificates are no longer sent to unauthenticated endpoints.\n4. Deploy the updated application to staging and production environments.\n\n## References\n\n- [GitHub Security Advisory GHSA-pw6j-qg29-8w7f](https://github.com/advisories/GHSA-pw6j-qg29-8w7f)\n- [Tornado Security Advisory](https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw6j-qg29-8w7f)\n- [Affected Source File (v6.5.6)](https://raw.githubusercontent.com/tornadoweb/tornado/v6.5.6/tornado/curl_httpclient.py)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-PW6J-QG29-8W7F) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-16T01:11:25.000000Z"}, {"uuid": "0f476725-50f7-4055-abd2-dedecddaa57f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-pw6j-qg29-8w7f", "type": "seen", "source": "https://gist.github.com/alon710/23808c1f8380a92515abff40b7e06b99", "content": "# GHSA-PW6J-QG29-8W7F: GHSA-pw6j-qg29-8w7f: State Persistence and Sensitive Credential Leakage in Tornado CurlAsyncHTTPClient\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-06-15\n> **Full Report:** https://cvereports.com/reports/GHSA-PW6J-QG29-8W7F\n\n## Summary\nA state persistence vulnerability exists in Tornado's CurlAsyncHTTPClient component where pooled pycurl.Curl handles are reused across asynchronous requests without a complete state reset. Consequently, sensitive per-request configurations, such as client TLS certificates or proxy basic authentication credentials, persist on the shared handle. This behavior leads to subsequent requests leaking these credentials to unauthorized remote servers.\n\n## TL;DR\nTornado's CurlAsyncHTTPClient reuses pycurl handles without resetting configuration state, leading to client certificate and proxy credential leakage to unintended destinations.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200, CWE-672\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: High (AC:H)\n- **CVSS Score**: 5.9 (Medium)\n- **Exploit Status**: PoC (Proof of Concept) Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Tornado Web Framework (CurlAsyncHTTPClient)\n- **tornado**: <= 6.5.6 (Fixed in: `6.5.7`)\n\n## Mitigation\n\n- Upgrade Tornado dependency to version 6.5.7 or later.\n- Replace CurlAsyncHTTPClient with the native SimpleAsyncHTTPClient backend if custom proxy or mTLS features are not required.\n- Isolate client instances by security context to prevent high-privilege handles from being reused for public outbound requests.\n\n**Remediation Steps:**\n1. Identify all instances of CurlAsyncHTTPClient configuration in the codebase.\n2. Update requirements.txt, setup.py, or Pipfile configurations to enforce tornado>=6.5.7.\n3. Run the provided test suite to verify that client certificates are no longer sent to unauthenticated endpoints.\n4. Deploy the updated application to staging and production environments.\n\n## References\n\n- [GitHub Security Advisory GHSA-pw6j-qg29-8w7f](https://github.com/advisories/GHSA-pw6j-qg29-8w7f)\n- [Tornado Security Advisory](https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw6j-qg29-8w7f)\n- [Affected Source File (v6.5.6)](https://raw.githubusercontent.com/tornadoweb/tornado/v6.5.6/tornado/curl_httpclient.py)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-PW6J-QG29-8W7F) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-16T01:11:21.000000Z"}, {"uuid": "37439d82-dc3f-4ecb-9674-b74e5b40df5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-pw6j-qg29-8w7f", "type": "seen", "source": "https://gist.github.com/alon710/da17ca39b5cf297de40d5deb00bccecd", "content": "# GHSA-PW6J-QG29-8W7F: GHSA-pw6j-qg29-8w7f: State Persistence and Sensitive Credential Leakage in Tornado CurlAsyncHTTPClient\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-06-15\n> **Full Report:** https://cvereports.com/reports/GHSA-PW6J-QG29-8W7F\n\n## Summary\nA state persistence vulnerability exists in Tornado's CurlAsyncHTTPClient component where pooled pycurl.Curl handles are reused across asynchronous requests without a complete state reset. Consequently, sensitive per-request configurations, such as client TLS certificates or proxy basic authentication credentials, persist on the shared handle. This behavior leads to subsequent requests leaking these credentials to unauthorized remote servers.\n\n## TL;DR\nTornado's CurlAsyncHTTPClient reuses pycurl handles without resetting configuration state, leading to client certificate and proxy credential leakage to unintended destinations.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200, CWE-672\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: High (AC:H)\n- **CVSS Score**: 5.9 (Medium)\n- **Exploit Status**: PoC (Proof of Concept) Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Tornado Web Framework (CurlAsyncHTTPClient)\n- **tornado**: <= 6.5.6 (Fixed in: `6.5.7`)\n\n## Mitigation\n\n- Upgrade Tornado dependency to version 6.5.7 or later.\n- Replace CurlAsyncHTTPClient with the native SimpleAsyncHTTPClient backend if custom proxy or mTLS features are not required.\n- Isolate client instances by security context to prevent high-privilege handles from being reused for public outbound requests.\n\n**Remediation Steps:**\n1. Identify all instances of CurlAsyncHTTPClient configuration in the codebase.\n2. Update requirements.txt, setup.py, or Pipfile configurations to enforce tornado>=6.5.7.\n3. Run the provided test suite to verify that client certificates are no longer sent to unauthenticated endpoints.\n4. Deploy the updated application to staging and production environments.\n\n## References\n\n- [GitHub Security Advisory GHSA-pw6j-qg29-8w7f](https://github.com/advisories/GHSA-pw6j-qg29-8w7f)\n- [Tornado Security Advisory](https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw6j-qg29-8w7f)\n- [Affected Source File (v6.5.6)](https://raw.githubusercontent.com/tornadoweb/tornado/v6.5.6/tornado/curl_httpclient.py)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-PW6J-QG29-8W7F) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-16T01:21:14.000000Z"}]}