What is GHSA-jqv5-7x9v-7j83?

GHSA-jqv5-7x9v-7j83 is a security advisory published by GitHub Security Advisories with High severity. Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl...

Which CVE IDs does GHSA-jqv5-7x9v-7j83 cover?

GHSA-jqv5-7x9v-7j83 covers the following CVE IDs: CVE-2026-91992. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jqv5-7x9v-7j83?

GHSA-jqv5-7x9v-7j83 has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

GHSA-jqv5-7x9v-7j83HighCVSS 5.9

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl...

Vendor

GitHub Security Advisories

Published

September 15, 2026

Last Modified

September 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-91992 →

📋 Description

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.

🔗 References (4)

https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw6j-qg29-8w7f
https://nvd.nist.gov/vuln/detail/CVE-2026-91992
https://www.vulncheck.com/advisories/tornado-before-6.5.7-credential-leak-via-handle-reuse
https://github.com/advisories/GHSA-jqv5-7x9v-7j83