CVE-2026-91992

Canonical Ubuntu Linux: information disclosure

Risk score: 44/100
CVSS: 5.9 v3.1
Exploit chance (30 days): 0.3%
Published: 15 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persi…
Affected: Canonical Ubuntu Linux before 6.5.7
Fix: Upgrade Canonical Ubuntu Linux to 6.5.7 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Canonical Ubuntu Linux: Amber, patch this week. U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.

The flaws

CVE-2026-91992: Information disclosure (CVSS 5.9 · EPSS 0%)
CVE-2026-74221: Denial of service (CVSS 8.2 · EPSS 0%)
CVE-2026-74220: Denial of service (CVSS 8.2 · EPSS 0%)
CVE-2026-103262: Denial of service (CVSS 7.5 · EPSS 1%)

The fix

Upgrade Canonical Ubuntu Linux: 6.5.7 · 2026.10 · 6.5.9 or later on your release line

Who is exposed: Canonical Ubuntu Linux before 2026.10

Where it stands

No known exploitation

How it unfolded

21 Oct, Ubuntu security notices (official): USN-8930-2: U-Boot vulnerabilities
22 Oct, Ubuntu security notices (official): USN-8952-1: Tornado vulnerabilities

Connects to

Same weakness: Information disclosure (CWE-200). 197 other warnings in 30 days
Same product: Earlier Canonical Ubuntu Linux warnings. 15 in the last 90 days

Why it is Yellow

CVSS 5.9 medium
Named in a government or vendor bulletin

Government and vendor bulletins

USN-8952-1: Tornado vulnerabilities

References

Original description

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.

Last activity 22 Oct 2026. Patch Forecast updates every hour.