{"id":"CVE-2026-35536","title":"tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)","summary":"A flaw was found in Tornado. A remote attacker could exploit this vulnerability by injecting specially crafted characters into the `domain`, `path`, and `samesite` arguments when setting cookies. This could lead to cookie attribute injecti…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvssSource":"vendor","cwe":"CWE-88","vendor":"Red Hat","product":"Red Hat OpenShift AI 2.25","affected":["external_secrets_operator_for_red_hat_openshift","openshift_lightspeed","enterprise_linux_ai_rhel_ai 3","openshift_container_platform 4","enterprise_linux_server_optional_v_7_els","enterprise_linux_appstream_eus_v_10_0","enterprise_linux_appstream_v_10","enterprise_linux_appstream_e4s_v_9_2","enterprise_linux_appstream_eus_v_9_4","enterprise_linux_appstream_eus_v_9_6","enterprise_linux_appstream_v_9","openshift_ai 2.25","openshift_ai 3.3"],"patched":["enterprise_linux_server_optional_v_7_els","enterprise_linux_appstream_eus_v_10_0","enterprise_linux_appstream_v_10","enterprise_linux_appstream_e4s_v_9_2","enterprise_linux_appstream_eus_v_9_4","enterprise_linux_appstream_eus_v_9_6","enterprise_linux_appstream_v_9","openshift_ai 2.25","openshift_ai 3.3"],"published":"2026-04-03","updated":"2026-09-18","sourceUpdated":"2026-09-18T18:32:41+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35536.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35536.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-35536"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2454716"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-35536"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35536"},{"url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.5"},{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-78cv-mqj4-43f7"},{"url":"https://access.redhat.com/errata/RHSA-2026:24342"},{"url":"https://access.redhat.com/errata/RHSA-2026:20577"},{"url":"https://access.redhat.com/errata/RHSA-2026:13641"},{"url":"https://access.redhat.com/errata/RHSA-2026:19034"},{"url":"https://access.redhat.com/errata/RHSA-2026:20573"},{"url":"https://access.redhat.com/errata/RHSA-2026:20810"},{"url":"https://access.redhat.com/errata/RHSA-2026:20572"},{"url":"https://access.redhat.com/errata/RHSA-2026:13670"},{"url":"https://access.redhat.com/errata/RHSA-2026:19189"},{"url":"https://access.redhat.com/errata/RHSA-2026:65126"},{"url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"url":"https://github.com/tornadoweb/tornado"},{"url":"https://github.com/tornadoweb/tornado/commit/24a2d96ea115f663b223887deb0060f13974c104"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00237,"epssPercentile":0.14968,"aliases":["GHSA-fqwm-6jpj-5wxc","GHSA-78cv-mqj4-43f7","PYSEC-2026-2287"],"ecosystem":"pip","scores":{"vendor":5.4,"osv":7.2},"ingestedAt":"2026-07-08T18:25:46.808Z","slug":"CVE-2026-35536","body":"## Overview\n\nA flaw was found in Tornado. A remote attacker could exploit this vulnerability by injecting specially crafted characters into the `domain`, `path`, and `samesite` arguments when setting cookies. This could lead to cookie attribute injection, potentially allowing for information disclosure or manipulation of client-side data.\n\n## Vendor advisories\n\n- **RHSA-2026:24342** · Red Hat · fixed in: Red Hat Enterprise Linux Server Optional (v. 7 ELS) · released 2026-06-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:24342)\n- **RHSA-2026:20577** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20577)\n- **RHSA-2026:13641** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-05-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:13641)\n- **RHSA-2026:19034** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:19034)\n- **RHSA-2026:20573** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20573)\n- **RHSA-2026:20810** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.4) · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20810)\n- **RHSA-2026:20572** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20572)\n- **RHSA-2026:13670** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-05-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:13670)\n- **RHSA-2026:19189** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:19189)\n- **RHSA-2026:65126** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65126)\n- **RHSA-2026:37275** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37275)\n- **Red Hat VEX** · Moderate · affected: External Secrets Operator for Red Hat OpenShift, OpenShift Lightspeed, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift Container Platform 4 · no fix planned: External Secrets Operator for Red Hat OpenShift, OpenShift Lightspeed, Red Hat Enterprise Linux AI (RHEL AI) 3 · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35536.json)\n\n**tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments** — rated Moderate by Red Hat. Released 2026-04-03, updated 2026-09-18.\n\nAffected:\n\n- External Secrets Operator for Red Hat OpenShift\n- OpenShift Lightspeed\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift Container Platform 4\n\nFixed:\n\n- Red Hat Enterprise Linux Server Optional (v. 7 ELS)\n- Red Hat Enterprise Linux AppStream EUS (v. 10.0)\n- Red Hat Enterprise Linux AppStream (v. 10)\n- Red Hat Enterprise Linux AppStream E4S (v.9.2)\n- Red Hat Enterprise Linux AppStream EUS (v.9.4)\n- Red Hat Enterprise Linux AppStream EUS (v.9.6)\n- Red Hat Enterprise Linux AppStream (v. 9)\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift AI 3.3\n\nNo fix planned:\n\n- External Secrets Operator for Red Hat OpenShift\n- OpenShift Lightspeed\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n\nNot affected:\n\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift AI 3.3\n- Lightspeed Core\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:24342\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:20577\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:13641\n\n## Package advisory (CVE-2026-35536)\n\nAffected packages:\n\n- `tornado < 6.5.5`\n\nPatched in:\n\n- `tornado 6.5.5`\n\nSource: https://osv.dev/vulnerability/GHSA-fqwm-6jpj-5wxc","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":208135,"id":"CVE-2026-35536","ts":1789922722881,"field":"cvss","old":"7.2","new":"5.4"},{"seq":208134,"id":"CVE-2026-35536","ts":1789922722881,"field":"severity","old":"high","new":"medium"},{"seq":201615,"id":"CVE-2026-35536","ts":1789399555049,"field":"cvss","old":"5.4","new":"7.2"},{"seq":201614,"id":"CVE-2026-35536","ts":1789399555049,"field":"severity","old":"medium","new":"high"},{"seq":200347,"id":"CVE-2026-35536","ts":1789397142697,"field":"cvss","old":"7.2","new":"5.4"},{"seq":200346,"id":"CVE-2026-35536","ts":1789397142697,"field":"severity","old":"high","new":"medium"},{"seq":198271,"id":"CVE-2026-35536","ts":1789391778581,"field":"cvss","old":"5.4","new":"7.2"},{"seq":198270,"id":"CVE-2026-35536","ts":1789391778581,"field":"severity","old":"medium","new":"high"},{"seq":196064,"id":"CVE-2026-35536","ts":1789383431280,"field":"cvss","old":"7.2","new":"5.4"},{"seq":196063,"id":"CVE-2026-35536","ts":1789383431280,"field":"severity","old":"high","new":"medium"},{"seq":194993,"id":"CVE-2026-35536","ts":1789380334597,"field":"cvss","old":"5.4","new":"7.2"},{"seq":194992,"id":"CVE-2026-35536","ts":1789380334597,"field":"severity","old":"medium","new":"high"},{"seq":193780,"id":"CVE-2026-35536","ts":1789378296642,"field":"cvss","old":"7.2","new":"5.4"},{"seq":193779,"id":"CVE-2026-35536","ts":1789378296642,"field":"severity","old":"high","new":"medium"},{"seq":192567,"id":"CVE-2026-35536","ts":1789376277237,"field":"cvss","old":"5.4","new":"7.2"},{"seq":192566,"id":"CVE-2026-35536","ts":1789376277237,"field":"severity","old":"medium","new":"high"},{"seq":191354,"id":"CVE-2026-35536","ts":1789373158157,"field":"cvss","old":"7.2","new":"5.4"},{"seq":191353,"id":"CVE-2026-35536","ts":1789373158157,"field":"severity","old":"high","new":"medium"},{"seq":190139,"id":"CVE-2026-35536","ts":1789369150624,"field":"cvss","old":"5.4","new":"7.2"},{"seq":190138,"id":"CVE-2026-35536","ts":1789369150624,"field":"severity","old":"medium","new":"high"},{"seq":188926,"id":"CVE-2026-35536","ts":1789368059100,"field":"cvss","old":"7.2","new":"5.4"},{"seq":188925,"id":"CVE-2026-35536","ts":1789368059100,"field":"severity","old":"high","new":"medium"},{"seq":187709,"id":"CVE-2026-35536","ts":1789365024052,"field":"cvss","old":"5.4","new":"7.2"},{"seq":187708,"id":"CVE-2026-35536","ts":1789365024052,"field":"severity","old":"medium","new":"high"},{"seq":186496,"id":"CVE-2026-35536","ts":1789363037645,"field":"cvss","old":"7.2","new":"5.4"},{"seq":186495,"id":"CVE-2026-35536","ts":1789363037645,"field":"severity","old":"high","new":"medium"},{"seq":185282,"id":"CVE-2026-35536","ts":1789360981970,"field":"cvss","old":"5.4","new":"7.2"},{"seq":185281,"id":"CVE-2026-35536","ts":1789360981970,"field":"severity","old":"medium","new":"high"},{"seq":184069,"id":"CVE-2026-35536","ts":1789357967826,"field":"cvss","old":"7.2","new":"5.4"},{"seq":184068,"id":"CVE-2026-35536","ts":1789357967826,"field":"severity","old":"high","new":"medium"},{"seq":182321,"id":"CVE-2026-35536","ts":1789354122312,"field":"cvss","old":"5.4","new":"7.2"},{"seq":182320,"id":"CVE-2026-35536","ts":1789354122312,"field":"severity","old":"medium","new":"high"},{"seq":181114,"id":"CVE-2026-35536","ts":1789352973476,"field":"cvss","old":"7.2","new":"5.4"},{"seq":181113,"id":"CVE-2026-35536","ts":1789352973476,"field":"severity","old":"high","new":"medium"},{"seq":179907,"id":"CVE-2026-35536","ts":1789350032416,"field":"cvss","old":"5.4","new":"7.2"},{"seq":179906,"id":"CVE-2026-35536","ts":1789350032416,"field":"severity","old":"medium","new":"high"},{"seq":178700,"id":"CVE-2026-35536","ts":1789347874737,"field":"cvss","old":"7.2","new":"5.4"},{"seq":178699,"id":"CVE-2026-35536","ts":1789347874737,"field":"severity","old":"high","new":"medium"},{"seq":177493,"id":"CVE-2026-35536","ts":1789346198677,"field":"cvss","old":"5.4","new":"7.2"},{"seq":177492,"id":"CVE-2026-35536","ts":1789346198677,"field":"severity","old":"medium","new":"high"},{"seq":176286,"id":"CVE-2026-35536","ts":1789342782068,"field":"cvss","old":"7.2","new":"5.4"},{"seq":176285,"id":"CVE-2026-35536","ts":1789342782068,"field":"severity","old":"high","new":"medium"},{"seq":175740,"id":"CVE-2026-35536","ts":1789338582215,"field":"cvss","old":"5.4","new":"7.2"},{"seq":175739,"id":"CVE-2026-35536","ts":1789338582215,"field":"severity","old":"medium","new":"high"},{"seq":175610,"id":"CVE-2026-35536","ts":1789338406556,"field":"cvss","old":"7.2","new":"5.4"},{"seq":175609,"id":"CVE-2026-35536","ts":1789338406556,"field":"severity","old":"high","new":"medium"},{"seq":174405,"id":"CVE-2026-35536","ts":1789334616417,"field":"cvss","old":"5.4","new":"7.2"},{"seq":174404,"id":"CVE-2026-35536","ts":1789334616417,"field":"severity","old":"medium","new":"high"},{"seq":173200,"id":"CVE-2026-35536","ts":1789333262001,"field":"cvss","old":"7.2","new":"5.4"},{"seq":173199,"id":"CVE-2026-35536","ts":1789333262001,"field":"severity","old":"high","new":"medium"}]}