p PatchFirst

CVE-2026-35536

CVE-2026-35536

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

CVSS 7.2 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • tornado

    Versions
    • ≥ 0, < 6.5.5: Affected (semver)

    Update to 6.5.5

  • python-tornado Debian:12

    Versions
    • 6.2.0-3
    • 6.2.0-3+deb12u1
    • 6.2.0-3+deb12u2
    • 6.2.0-3+deb12u3
    • 6.2.0-3+deb12u4
    • 6.3.2-1
    • 6.4.0-1
    • 6.4.0-2
    • 6.4.1-1
    • 6.4.1-2
    • 6.4.1-3
    • 6.4.2-1
    • 6.4.2-2
    • 6.4.2-3
    • 6.5.2-1
    • 6.5.2-2
    • 6.5.2-3
    • 6.5.4-0.1
    • 6.5.4-1
    • 6.5.5-1
    • 6.5.5-2
    • 6.5.5-3
    • 6.5.5-4
    • 6.5.5-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-tornado Debian:13

    Versions
    • 6.4.2-3
    • 6.4.2-3+deb13u1
    • 6.4.2-3+deb13u2
    • 6.5.2-1
    • 6.5.2-2
    • 6.5.2-3
    • 6.5.4-0.1
    • 6.5.4-1
    • 6.5.5-1
    • 6.5.5-2
    • 6.5.5-3
    • 6.5.5-4
    • 6.5.5-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-tornado Debian:14

    Versions
    • 6.4.2-3
    • 6.5.2-1
    • 6.5.2-2
    • 6.5.2-3
    • 6.5.4-0.1
    • 6.5.4-1
    Affected ranges
    • ECOSYSTEM: < 6.5.5-1

    Update to 6.5.5-1

  • tornado PyPI

    Versions
    • 0.2
    • 1.0
    • 1.1
    • 1.1.1
    • 1.2
    • 1.2.1
    • 2.0
    • 2.1
    • 2.1.1
    • 2.2
    • 2.2.1
    • 2.3
    • 2.4
    • 2.4.1
    • 3.0
    • 3.0.1
    • 3.0.2
    • 3.1
    • 3.1.1
    • 3.2
    • 3.2.1
    • 3.2.2
    • 4.0
    • 4.0.1
    • 4.0.2
    • 4.1
    • 4.1b2
    • 4.2
    • 4.2.1
    • 4.2b1
    • 4.3
    • 4.3b1
    • 4.3b2
    • 4.4
    • 4.4.1
    • 4.4.2
    • 4.4.3
    • 4.4b1
    • 4.5
    • 4.5.1
    • 4.5.2
    • 4.5.3
    • 4.5b1
    • 4.5b2
    • 5.0
    • 5.0.1
    • 5.0.2
    • 5.0a1
    • 5.0b1
    • 5.1
    • 5.1.1
    • 5.1b1
    • 6.0
    • 6.0.1
    • 6.0.2
    • 6.0.3
    • 6.0.4
    • 6.0a1
    • 6.0b1
    • 6.1
    • 6.1b1
    • 6.1b2
    • 6.2
    • 6.2b1
    • 6.2b2
    • 6.3
    • 6.3.1
    • 6.3.2
    • 6.3.3
    • 6.3b1
    • 6.4
    • 6.4.1
    • 6.4.2
    • 6.4b1
    • 6.5
    • 6.5.1
    • 6.5.2
    • 6.5.3
    • 6.5.4
    • 6.5b1
    Affected ranges
    • ECOSYSTEM: < 6.5.5

    Update to 6.5.5

  • python-tornado Ubuntu:Pro:16.04:LTS

    Versions
    • 4.2.1-1ubuntu2
    • 4.2.1-1ubuntu3
    • 4.2.1-1ubuntu3.1
    • 4.2.1-1ubuntu3.1+esm1
    • 4.2.1-1ubuntu3.1+esm2
    Affected ranges
    • ECOSYSTEM: < 4.2.1-1ubuntu3.1+esm3

    Update to 4.2.1-1ubuntu3.1+esm3

  • python-tornado Ubuntu:Pro:18.04:LTS

    Versions
    • 4.5.1-2.1~build2
    • 4.5.2-1
    • 4.5.3-1
    • 4.5.3-1ubuntu0.1
    • 4.5.3-1ubuntu0.2
    • 4.5.3-1ubuntu0.2+esm1
    • 4.5.3-1ubuntu0.2+esm2
    Affected ranges
    • ECOSYSTEM: < 4.5.3-1ubuntu0.2+esm3

    Update to 4.5.3-1ubuntu0.2+esm3

  • python-tornado Ubuntu:Pro:22.04:LTS

    Versions
    • 6.1.0-1build1
    • 6.1.0-2
    • 6.1.0-3
    • 6.1.0-3build1
    • 6.1.0-3ubuntu0.1~esm1
    • 6.1.0-3ubuntu0.1~esm2
    • 6.1.0-3ubuntu0.1~esm4
    Affected ranges
    • ECOSYSTEM: < 6.1.0-3ubuntu0.1~esm5

    Update to 6.1.0-3ubuntu0.1~esm5

  • python-tornado Ubuntu:24.04:LTS

    Versions
    • 6.3.2-1
    • 6.4.0-0ubuntu1
    • 6.4.0-1
    • 6.4.0-1build1
    • 6.4.0-1ubuntu0.1
    • 6.4.0-1ubuntu0.2
    • 6.4.0-1ubuntu0.4
    Affected ranges
    • ECOSYSTEM: < 6.4.0-1ubuntu0.5

    Update to 6.4.0-1ubuntu0.5

  • python-tornado Ubuntu:25.10

    Versions
    • 6.4.2-1
    • 6.4.2-2
    • 6.4.2-2ubuntu1
    • 6.4.2-3
    • 6.4.2-3ubuntu0.2
    Affected ranges
    • ECOSYSTEM: < 6.4.2-3ubuntu0.3

    Update to 6.4.2-3ubuntu0.3

  • python-tornado Ubuntu:26.04:LTS

    Versions
    • 6.4.2-3
    • 6.5.2-3
    • 6.5.4-0.1
    Affected ranges
    • ECOSYSTEM: < 6.5.4-0.1ubuntu0.1

    Update to 6.5.4-0.1ubuntu0.1

Original sources

Check your server →