p PatchFirst

CVE-2026-91991

CVE-2026-91991 · Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.

CVSS 6.3 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • tornado

    Versions
    • ≥ 6.5.5, < 6.5.8: Affected (semver)
    • 6.5.8: Not affected (semver)

    Update to 6.5.8

  • python-tornado Debian:12

    Versions
    • 6.2.0-3
    • 6.2.0-3+deb12u1
    • 6.2.0-3+deb12u2
    • 6.2.0-3+deb12u3
    • 6.2.0-3+deb12u4
    • 6.3.2-1
    • 6.4.0-1
    • 6.4.0-2
    • 6.4.1-1
    • 6.4.1-2
    • 6.4.1-3
    • 6.4.2-1
    • 6.4.2-2
    • 6.4.2-3
    • 6.5.2-1
    • 6.5.2-2
    • 6.5.2-3
    • 6.5.4-0.1
    • 6.5.4-1
    • 6.5.5-1
    • 6.5.5-2
    • 6.5.5-3
    • 6.5.5-4
    • 6.5.5-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-tornado Debian:14

    Versions
    • 6.4.2-3
    • 6.5.2-1
    • 6.5.2-2
    • 6.5.2-3
    • 6.5.4-0.1
    • 6.5.4-1
    • 6.5.5-1
    • 6.5.5-2
    • 6.5.5-3
    • 6.5.5-4
    • 6.5.5-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tornado PyPI

    Versions
    • 6.5.5
    • 6.5.6
    • 6.5.7
    Affected ranges
    • ECOSYSTEM: ≥ 6.5.5, < 6.5.8

    Update to 6.5.8

  • python-tornado Ubuntu:Pro:16.04:LTS

    Versions
    • 4.2.1-1ubuntu2
    • 4.2.1-1ubuntu3
    • 4.2.1-1ubuntu3.1
    • 4.2.1-1ubuntu3.1+esm1
    • 4.2.1-1ubuntu3.1+esm2
    • 4.2.1-1ubuntu3.1+esm3
    • 4.2.1-1ubuntu3.1+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-tornado Ubuntu:Pro:18.04:LTS

    Versions
    • 4.5.1-2.1~build2
    • 4.5.2-1
    • 4.5.3-1
    • 4.5.3-1ubuntu0.1
    • 4.5.3-1ubuntu0.2
    • 4.5.3-1ubuntu0.2+esm1
    • 4.5.3-1ubuntu0.2+esm2
    • 4.5.3-1ubuntu0.2+esm3
    • 4.5.3-1ubuntu0.2+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-tornado Ubuntu:Pro:20.04:LTS

    Versions
    • 5.1.1-4ubuntu1
    • 5.1.1-4ubuntu5
    • 6.0.3+really5.1.1-2
    • 6.0.3+really5.1.1-2build1
    • 6.0.3+really5.1.1-2build2
    • 6.0.3+really5.1.1-3
    • 6.0.3+really5.1.1-3ubuntu0.1~esm1
    • 6.0.3+really5.1.1-3ubuntu0.1~esm3
    • 6.0.3+really5.1.1-3ubuntu0.1~esm5
    • 6.0.3+really5.1.1-3ubuntu0.1~esm7
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-tornado Ubuntu:Pro:22.04:LTS

    Versions
    • 6.1.0-1build1
    • 6.1.0-2
    • 6.1.0-3
    • 6.1.0-3build1
    • 6.1.0-3ubuntu0.1~esm1
    • 6.1.0-3ubuntu0.1~esm2
    • 6.1.0-3ubuntu0.1~esm4
    • 6.1.0-3ubuntu0.1~esm5
    • 6.1.0-3ubuntu0.1~esm6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-tornado Ubuntu:24.04:LTS

    Versions
    • 6.3.2-1
    • 6.4.0-0ubuntu1
    • 6.4.0-1
    • 6.4.0-1build1
    • 6.4.0-1ubuntu0.1
    • 6.4.0-1ubuntu0.2
    • 6.4.0-1ubuntu0.4
    • 6.4.0-1ubuntu0.5
    • 6.4.0-1ubuntu0.6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-tornado Ubuntu:26.10

    Versions
    • 6.5.4-0.1
    • 6.5.5-2
    • 6.5.5-4
    • 6.5.5-5
    • 6.5.5-5ubuntu1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-tornado Ubuntu:26.04:LTS

    Versions
    • 6.4.2-3
    • 6.5.2-3
    • 6.5.4-0.1
    • 6.5.4-0.1ubuntu0.1
    • 6.5.4-0.1ubuntu0.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →