GHSA-pw6j-qg29-8w7f — Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse

Affected: PyPI: tornado

# CurlAsyncHTTPClient leaks per-request credentials on handle reuse

## Summary

`CurlAsyncHTTPClient` pools and reuses `pycurl` handles across requests but does not reset them between requests, and several per-request options are applied with no clearing branch. As a result, sensitive state set by one request persists onto a later request on the same client that does not set it. Two credential vectors are demonstrated below — a client TLS certificate (`SSLCERT`/`SSLKEY`) and proxy basic-auth credentials (`PROXYUSERPWD`) — both leaking to a different, unintended host. This affects all released versions through 6.5.6.

## Details

In `tornado/curl_httpclient.py`, handles are created once and returned to a free list for reuse (`_process_queue` pops the handle at line 200, `_finish` re-appends it at line 245), and `_curl_setup_request` is never preceded by `curl.reset()`. The function clears *some* carried-over state on the reused handle — `unsetopt(PROXYUSERPWD)` in the no-proxy branch (line 394), `unsetopt(USERPWD)` when no auth is set (line 495), and the HTTP-method flag reset (lines 428-432) — but other options have no equivalent clearing path and persist until a later request sets them again.

**Vector A — client TLS certificate (`SSLCERT`/`SSLKEY`).** Set-only, no clearing branch:

```python # tornado/curl_httpclient.py (v6.5.6), lines 498-502 if request.client_cert is not None: curl.setopt(pycurl.SSLCERT, request.client_cert)

if request.client_key is not None: c…

Most recent entries from all

GHSA-pw6j-qg29-8w7f — Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse