Announcing Tornado 6.5.7

[Ben Darnell]

Tornado 6.5.7 is now available on PyPI. This releases fixes a security issue in `curl_httpclient` when client SSL certificates or an authenticated proxy is used. 

https://www.tornadoweb.org/en/stable/releases/v6.5.7.html

What’s new in Tornado 6.5.7¶

Jun 8, 2026¶

Security fixes¶

• CurlAsyncHTTPClient now fully resets the curl object before reusing it. This prevents incorrectly reusing options from a previous request, specifically including client SSL and credentials used for accessing proxies. Thanks to Koh Jun Sheng for reporting this issue.