CVE-2026-35536
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.
Risk Assessment
Risk of cookie manipulation, potentially leading to session fixation or session hijacking attacks.
Recommendation
Update Tornado to version 6.5.5 or later.
Other vulnerabilities in Tornado
See all- CVE-2026-49855High
A vulnerability in Tornado before version 6.5.6 allows unlimited decompression of gzip data, potentially leading to memory exhaustion by a malicious server or SimpleAsyncHTTPClient.
- CVE-2026-49854Medium
In Tornado before version 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes. This allows the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active.
- CVE-2026-49853High
In Tornado before version 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.
Original NVD description (English source)
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.