GHSA-fqwm-6jpj-5wxc

Tornado has cookie attribute injection via .RequestHandler.set_cookie

Source: GitHub Advisory Database (reviewed) High CVE-2026-35536

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	tornado	< 6.5.5	6.5.5

Details

As written in the advisory (Markdown source, shown as plain text).

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to `.RequestHandler.set_cookie` were not checked for crafted characters.

References

External links from the advisory. They lead to third-party sites.

https://github.com/tornadoweb/tornado/security/advisories/GHSA-78cv-mqj4-43f7 web
https://nvd.nist.gov/vuln/detail/CVE-2026-35536 advisory
https://github.com/tornadoweb/tornado package
https://github.com/tornadoweb/tornado/releases/tag/v6.5.5 web