Sign in
Deutsch English Español Polski
Low

Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`

  • Disclosed: 01.09.2026
  • Updated: 11.10.2026 15:18

Summary

The CVE-2026-35536 fix added a validation loop that rejects [\x00-\x20\x3b\x7f], but only for the hardcoded lowercase keys name/domain/path/samesite. The still-live deprecated **kwargs path writes attacker-supplied attribute values straight into the Morsel with no validation, and because Morsel.__setitem__ is case-insensitive, a capitalized kwarg (Domain=, Path=, SameSite=, Max-Age=) routes to the same reserved attribute while bypassing the loop — re-opening ;-delimited attribute injection.

python
self.set_cookie("sid", "abc", Domain="evil.com; Secure; SameSite=None")
#  -> Set-Cookie: sid=abc; Domain=evil.com; Secure; SameSite=None; Path=/
# Sanity (the canonical lowercase named arg IS blocked):
self.set_cookie("sid", "abc", domain="evil.com; Secure")   # -> http.cookies.CookieError

The patch's regression test (SetCookieForbiddenCharHandler) only exercises the four named params, never the **kwargs path, so the gap is not regression-covered.

Affected code

  • tornado/web.py → RequestHandler.set_cookie: the validation loop covers only the lowercase named args; the trailing if kwargs: loop does morsel[k] = v with no character validation.

Steps to reproduce

GET /upper (uses Domain= kwarg) emits Set-Cookie: c_upper=v; Domain=evil.com; Secure; SameSite=None; Path=/; GET /lower (uses lowercase domain=) returns a CookieError.

Impact

Injection of independent cookie attributes (force/drop Secure/HttpOnly/SameSite, rebind Domain/Path) — the same impact CVE-2026-35536 closed, via the sibling path the patch missed. Conditional on the app using a capitalized/legacy keyword.

Suggested remediation

Apply the same [\x00-\x20\x3b\x7f] validation to every entry in the **kwargs loop (after normalizing the key case), or remove the deprecated kwargs path; add a regression test for capitalized kwargs.

Credit

Reported as part of an incomplete-patch measurement study (responsible disclosure).

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) tornado >= 6.5.5, < 6.5.8 6.5.8

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness (CWE)
CWE-74
Platform
Python (PyPI)
Package
tornado
Disclosed
01.09.2026
Updated
11.10.2026 15:18

Sources and licenses

OSV / GitHub Advisory Database - GHSA-wwv5-g3v4-889x - CC BY 4.0

Vulnerability history: tornado

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (23) in the archive
Total entries
23
First → latest
05.2012 09.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • High 13
  • Medium 8
  • Low 2

Disclosures per year

earlier: 1

Severity:
  1. tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
    High · 7.5 CVE-2026-103262 < 6.5.9 6.5.9
  2. Tornado: StaticFileHandler follows symlinks outside static root (path traversal)
    High CVE-2026-103263 < 6.5.9 6.5.9
  3. Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
    High · 7.5 CVE-2026-82397 < 6.5.8 6.5.8
  4. Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie` this entry
    Low CVE-2026-91991 >= 6.5.5, < 6.5.8 6.5.8
  5. Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
    High · 7.7 CVE-2026-49853 < 6.5.6 6.5.6
  6. tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)
    High · 7.5 CVE-2026-49855 < 6.5.6 6.5.6
  7. Tornado has cookie attribute injection via .RequestHandler.set_cookie
    High · 7.2 CVE-2026-35536 < 6.5.5 6.5.5
  8. Tornado is vulnerable to DoS due to too many multipart parts
    High · 7.5 CVE-2026-31958 < 6.5.5 6.5.5
  9. Tornado: Quadratic DoS via Crafted Multipart Parameters
    High · 7.5 CVE-2025-67726 < 6.5.3 6.5.3
  10. Tornado: Quadratic DoS via Repeated Header Coalescing
    High · 7.5 CVE-2025-67725 < 6.5.3 6.5.3
  11. Tornado vulnerable to excessive logging caused by malformed multipart form data
    High · 7.5 CVE-2025-47287 < 6.5 6.5
  12. Tornado has an HTTP cookie parsing DoS vulnerability
    High · 7.5 CVE-2024-52804 < 6.4.2 6.4.2
  13. Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determin
    High · 6.5 CVE-2014-9720 < 3.2.2 3.2.2
  14. CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting
    High · 7.5 CVE-2012-2374 < 2.2.1 2.2.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.