GHSA-pw6j-qg29-8w7f: State Persistence and Sensitive Credential Leakage in Tornado CurlAsyncHTTPClient

Vulnerability ID: GHSA-PW6J-QG29-8W7F
CVSS Score: 5.9
Published: 2026-06-15

A state persistence vulnerability exists in Tornado's CurlAsyncHTTPClient component where pooled pycurl.Curl handles are reused across asynchronous requests without a complete state reset. Consequently, sensitive per-request configurations, such as client TLS certificates or proxy basic authentication credentials, persist on the shared handle. This behavior leads to subsequent requests leaking these credentials to unauthorized remote servers.

TL;DR

Tornado's CurlAsyncHTTPClient reuses pycurl handles without resetting configuration state, leading to client certificate and proxy credential leakage to unintended destinations.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-200, CWE-672
• Attack Vector: Network (AV:N)
• Attack Complexity: High (AC:H)
• CVSS Score: 5.9 (Medium)
• Exploit Status: PoC (Proof of Concept) Available
• KEV Status: Not Listed

Affected Systems

• Tornado Web Framework (CurlAsyncHTTPClient)
• tornado: <= 6.5.6 (Fixed in: 6.5.7)

Mitigation Strategies

• Upgrade Tornado dependency to version 6.5.7 or later.
• Replace CurlAsyncHTTPClient with the native SimpleAsyncHTTPClient backend if custom proxy or mTLS features are not required.
• Isolate client instances by security context to prevent high-privilege handles from being reused for public outbound requests.

Remediation Steps:

1. Identify all instances of CurlAsyncHTTPClient configuration in the codebase.
2. Update requirements.txt, setup.py, or Pipfile configurations to enforce tornado>=6.5.7.
3. Run the provided test suite to verify that client certificates are no longer sent to unauthenticated endpoints.
4. Deploy the updated application to staging and production environments.

References

• GitHub Security Advisory GHSA-pw6j-qg29-8w7f
• Tornado Security Advisory
• Affected Source File (v6.5.6)

Read the full report for GHSA-PW6J-QG29-8W7F on our website for more details including interactive diagrams and full exploit analysis.