MEDIUM 6.3 NVD
CVE-2026-91991
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalize
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.
References
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-wwv5-g3v4-889x
- https://www.vulncheck.com/advisories/tornado-before-6.5.8-cookie-attribute-injection-via-c
This medium severity vulnerability with a CVSS score of 6.3 was published on 2026-09-15 via NVD.
vulnfeed aggregates 13549 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.