Cookie Attribute Injection Vulnerability in Tornado Web Framework
CVE-2026-91991

6.3MEDIUM

Key Information:

Vendor

Tornadoweb

Status
Tornado
Vendor
CVE Published:
15 September 2026

What is CVE-2026-91991?

The Tornado web framework prior to version 6.5.8 has a vulnerability that allows for cookie attribute injection through incomplete fixes. Attackers can exploit this by providing capitalized or legacy keyword arguments to the 'set_cookie' function, enabling them to inject malicious attributes into cookies. This could lead to the alteration of crucial security attributes like Domain, Path, or SameSite, disrupting the intended cookie behavior and security protocols. It's vital for users of the affected versions to review the GitHub Security Advisory and take action to mitigate this vulnerability.

Affected Version(s)

tornado 6.5.5 < 6.5.8

tornado 6.5.8

References

https://github.com/tornadoweb/tornado/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/tornado-before-6.5.8...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

sec-reex
arpitjain099
.