GHSA-fqwm-6jpj-5wxc
Tornado has cookie attribute injection via .RequestHandler.set_cookie
At a glance
- Published
- Updated
- CVE
- CVE-2026-35536
- Aliases
- GHSA-78cv-mqj4-43f7, PYSEC-2026-2287
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Description
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to `.RequestHandler.set_cookie` were not checked for crafted characters.
Affected packages
| Package | Versions |
|---|---|
| PyPI · tornado | introduced 0, fixed 6.5.5 |
References
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-78cv-mqj4-43f7 WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-35536 ADVISORY
- https://github.com/tornadoweb/tornado PACKAGE
- https://github.com/tornadoweb/tornado/releases/tag/v6.5.5 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |