Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tornado | pip | < 6.5.6 | 6.5.6 |
Miggo AIRoot Cause AnalysisThe analysis began by examining the provided vulnerability details, which indicated an issue with SimpleAsyncHTTPClient in Tornado not clearing authorization headers on cross-origin redirects. The provided reference URLs led to a GitHub security advisory. To pinpoint the exact code change, I identified the patched version (6.5.6) and the last vulnerable version (6.5.5) from the advisory. By comparing the commits between the tags for these versions in the tornadoweb/tornado repository, I found a commit with the message 'simple_httpclient: Strip auth headers on cross-origin redirects'. This commit, e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5, contained the security fix. The changes were located in the _HTTPConnection.finish method within tornado/simple_httpclient.py. The patch explicitly adds logic to detect cross-origin redirects and strip the Authorization and Cookie headers, along with auth_username and auth_password. This directly addresses the described vulnerability. Therefore, the _HTTPConnection.finish function is identified as the vulnerable function because it previously lacked this critical security check, leading to potential credential leakage.
_HTTPConnection.finishtornado/simple_httpclient.py