AZL-103098

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-103098.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-103098

Upstream

CVE-2026-91992

Published

2026-09-15T16:17:58Z

Modified

2026-09-19T14:16:04Z

Summary

CVE-2026-91992 affecting package python-tornado 6.3.3-11

Details

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-91992

Affected packages

Azure Linux:3 / python-tornado

Package

Name: python-tornado
Purl: pkg:rpm/azure-linux/python-tornado

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

6.3.3-11

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-103098.json"