Operation on a Resource after Expiration or Release Affecting tornado package, versions [,6.5.7)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-TORNADO-17356157
- published17 Jun 2026
- disclosed15 Jun 2026
- creditKoh Jun Sheng
Introduced: 15 Jun 2026
CVE NOT AVAILABLE CWE-672 (opens in a new tab)How to fix?
Upgrade tornado to version 6.5.7 or higher.
Overview
tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.
Affected versions of this package are vulnerable to Operation on a Resource after Expiration or Release in the CurlAsyncHTTPClient, where per-request credentials such as client TLS certificates or proxy authentication details are not properly cleared when reusing handles across requests. An attacker can obtain sensitive credentials intended for a previous request by triggering a subsequent request to a different host or proxy, causing the credentials to be sent to an unintended recipient.
Note: This is only exploitable if the application uses the optional CurlAsyncHTTPClient backend and is configured in a manner that matches the affected proxy-related usage patterns. Applications using the default SimpleAsyncHTTPClient backend are not affected, as it does not support proxies.