CVE-2026-91991
published 2026-09-15CVE-2026-91991: Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing…
PriorityP431medium5.4CVSS 3.1
AVNACHPRNUINSCCLILAN
EPSS
0.25%
15.1th percentile
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| tornadoweb | tornado | >= 6.5.5 < 6.5.8 | 6.5.8 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
tornado: Tornado: Cookie attribute injection via capitalized keyword arguments
vendor_redhat·2026-09-15·CVSS 5.4
CVE-2026-91991 [MEDIUM] CWE-915 tornado: Tornado: Cookie attribute injection via capitalized keyword arguments
tornado: Tornado: Cookie attribute injection via capitalized keyword arguments
A flaw was found in Tornado. An attacker can bypass security validation in the `set_cookie` function by using capitalized or legacy keyword arguments. This allows the attacker to inject arbitrary cookie attributes, such as `Domain` or `SameSite`, and modify cookie security settings. The consequence is the potential to manipulate cookie behavior, which could lead to unintended security impacts.
GHSA
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_coo
ghsa_unreviewed·2026-09-15
CVE-2026-91991 [MEDIUM] CWE-113 Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_coo
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-91991 python-flit: Tornado: Cookie attribute injection via capitalized keyword arguments [epel-all]
bugzilla·2026-09-18·CVSS 5.4
CVE-2026-91991 [MEDIUM] CVE-2026-91991 python-flit: Tornado: Cookie attribute injection via capitalized keyword arguments [epel-all]
CVE-2026-91991 python-flit: Tornado: Cookie attribute injection via capitalized keyword arguments [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.
Bugzilla
CVE-2026-91991 python-pep517: Tornado: Cookie attribute injection via capitalized keyword arguments [epel-all]
bugzilla·2026-09-18·CVSS 5.4
CVE-2026-91991 [MEDIUM] CVE-2026-91991 python-pep517: Tornado: Cookie attribute injection via capitalized keyword arguments [epel-all]
CVE-2026-91991 python-pep517: Tornado: Cookie attribute injection via capitalized keyword arguments [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.
Bugzilla
CVE-2026-91991 python-flit: Tornado: Cookie attribute injection via capitalized keyword arguments [fedora-all]
bugzilla·2026-09-18·CVSS 5.4
CVE-2026-91991 [MEDIUM] CVE-2026-91991 python-flit: Tornado: Cookie attribute injection via capitalized keyword arguments [fedora-all]
CVE-2026-91991 python-flit: Tornado: Cookie attribute injection via capitalized keyword arguments [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.
Bugzilla
CVE-2026-91991 tornado: Tornado: Cookie attribute injection via capitalized keyword arguments
bugzilla·2026-09-15·CVSS 5.4
CVE-2026-91991 [MEDIUM] CVE-2026-91991 tornado: Tornado: Cookie attribute injection via capitalized keyword arguments
CVE-2026-91991 tornado: Tornado: Cookie attribute injection via capitalized keyword arguments
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.
2026-09-15
Published