Loading story…
The Tornado project released version 6.5.6 to address multiple security flaws affecting its HTTP client components and optional native extension. The most severe patched issue, CVE-2026-49853, allowed Authorization headers to be forwarded across origins when SimpleAsyncHTTPClient followed redirects, potentially exposing credentials because redirects are enabled by default. The release also fixed CVE-2026-49855, a gzip bomb denial-of-service vulnerability that could exhaust memory during response decompression, and CVE-2026-49854, a memory exposure flaw in Tornado’s optional native extension.
Separate reporting also detailed a high-impact credential leakage issue in Tornado’s CurlAsyncHTTPClient, tracked as GHSA-PW6J-QG29-8W7F, in which reused libcurl easy handles could retain prior request settings such as SSLCERT, SSLKEY, and PROXYUSERPWD. That behavior could cause client TLS certificate paths or proxy authentication credentials from one request to be reused in a later request, particularly in mTLS or authenticated proxy scenarios. Maintainers mitigated the broader set of issues by stripping Authorization and Cookie headers on cross-origin redirects and adding compressed and decompressed size checks, while users unable to upgrade were advised to consider temporary workarounds such as switching to SimpleAsyncHTTPClient, disabling decompression, or disabling the native extension.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The Tornado maintainers fixed three security vulnerabilities in the Python web framework with the release of Tornado 6.5.6. The update addressed CVE-2026-49853, CVE-2026-49855, and CVE-2026-49854, including protections for cross-origin redirect header leakage, gzip bomb decompression limits, and a native extension memory exposure bug.
A vulnerability affecting Tornado 6.5.6 and earlier was disclosed in which reused libcurl easy handles can retain prior SSLCERT, SSLKEY, and PROXYUSERPWD settings. This can cause client TLS certificate paths or proxy authentication credentials from one request to be unintentionally reused in a later request.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The curl project released **curl/libcurl 8.20.0** with fixes for several disclosed vulnerabilities that could leak credentials, cookies, or authenticated session state across requests, redirects, proxies, and reused connections. The most broadly exposed issue, **`CVE-2026-6253`**, allows proxy credentials to be forwarded to a different proxy during cross-scheme redirects when separate proxies are configured; it affects **curl and libcurl** from `7.14.1` through `8.19.0`. curl also fixed **`CVE-2026-5545`**, where HTTP(S) connections authenticated with **Negotiate** could be wrongly reused for a different user, potentially sending requests over a connection still authenticated as the first user; that flaw affects versions `7.10.6` through `8.19.0` and also impacts the command-line tool. Additional flaws primarily affect **libcurl** handle and connection reuse. **`CVE-2026-7168`** can leak **Digest proxy authentication state** when the same handle is reused across different HTTP proxies, **`CVE-2026-6429`** can expose **`.netrc` credentials** during HTTP redirects over a reused proxied connection, and **`CVE-2026-6276`** can send cookies for one host to another after reuse of an easy handle with a removed custom `Host:` header. The affected ranges span from `7.12.0` to `8.19.0` depending on the bug, and curl advised users to **upgrade to 8.20.0**, apply the published patches, or avoid risky patterns such as proxy credential use, custom `Host:` headers, `.netrc` with proxied cleartext HTTP, HTTP Negotiate, and handle reuse when switching proxies.
Jun 29, 2026
pyOpenSSL **26.0.0** was released with fixes for two security vulnerabilities tracked as **`CVE-2026-27459`** and **`CVE-2026-27448`**. The first issue is a buffer overflow in DTLS handling that can occur when a cookie callback returns a value longer than `DTLS1_COOKIE_LENGTH` bytes. The second affects `Context.set_tlsext_servername_callback`, where exceptions raised by the callback were previously swallowed and the TLS handshake continued as though the callback had completed successfully. The vulnerabilities were disclosed through the oss-security mailing list and corresponding GitHub security advisories, with **dark_haxor** credited for reporting `CVE-2026-27459` and **Leury Castillo** credited for reporting `CVE-2026-27448`. In follow-up discussion, pyOpenSSL maintainer Alex Gaynor said both issues require misbehaving Python code and are therefore unlikely to be exploitable, but the defects were nonetheless corrected in the new release.
Jun 29, 2026
Apache disclosed **CVE-2026-35337**, an important-severity remote code execution flaw in `org.apache.storm:storm-client` caused by unsafe deserialization of Kerberos ticket data. The vulnerability affects Apache Storm versions before **2.8.6** and is triggered when Nimbus processes topology credentials submitted through the Nimbus Thrift API, deserializing a base64-encoded Kerberos TGT blob with `ObjectInputStream.readObject()` without class filtering or validation. An authenticated user with topology submission rights can abuse the vulnerable `TGT` credential field to execute malicious code. Successful exploitation can result in code execution in both **Nimbus** and **Worker JVMs**. The issue is tracked as **CWE-502** and carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`. Apache credited the finding to a researcher identified as **K** and advised users to upgrade to **Apache Storm 2.8.6**; organizations unable to patch immediately were told to apply an `ObjectInputFilter` allow-list to `ClientAuthUtils.deserializeKerberosTicket()` as a temporary mitigation.
Jun 29, 2026