GitHub Advisoryadvisory · PyPI

GHSA-fqwm-6jpj-5wxc Tornado has cookie attribute injection via .RequestHandler.set_cookie

HIGH Published 2026-04-03 Modified 2026-04-04 Official page ↗
Aliases
CVE-2026-35536
Ecosystem
PyPI
Packages
tornado
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Weaknesses
CWE-159
Reviewed
2026-04-04

Affected packages

• PyPI tornado: < 6.5.5 → fixed in 6.5.5

Description

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to `.RequestHandler.set_cookie` were not checked for crafted characters.

Related

Alias · CVE (1)

  • CVE-2026-35536 In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to… vulnerability

Weakness · CWE (1)

  • CWE-159 Improper Handling of Invalid Use of Special Elements weakness

References