CVE-2026-123535: Tornado cookie attribute injection in set_cookie max_age

CVE-2026-123535 · Severity: medium · CVSS 4.2 · Published 2026-11-08

Tornado, a Python web framework, fails to validate the max_age argument when setting cookies, allowing attackers to inject additional cookie attributes. An attacker who can control the max_age parameter could expand a cookie's scope to unintended paths or subdomains, potentially enabling account takeover or session hijacking attacks if an application uses untrusted input.

Technologies: Tornado. Vendors: Tornado.

Quick answers

Is CVE-2026-123535 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-123535 being exploited in the wild.
How severe is CVE-2026-123535?
Medium severity, with a CVSS score of 4.2, published 8 November 2026.
Which products and versions are affected?
Tornado before 6.6.
Is there a fix for CVE-2026-123535?
Yes: fixed in 6.6.0. Until then: Convert the max_age argument to an integer (using int()) before passing it to set_cookie, set_signed_cookie, set_secure_cookie, or clear_cookie. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123535 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-123535?
Check whether you run Tornado at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 6.6.0

Convert the max_age argument to an integer (using int()) before passing it to set_cookie, set_signed_cookie, set_secure_cookie, or clear_cookie.

Technical details

The RequestHandler.set_cookie method (and its wrappers set_signed_cookie, set_secure_cookie, and clear_cookie) does not validate or convert the max_age argument to an integer before including it in the Set-Cookie HTTP header. An attacker providing a malicious string like "86400; Domain=example.com" as max_age can inject arbitrary Set-Cookie attributes. The vulnerability affects applications that pass untrusted string input directly; those converting to int() first are unaffected.

Affected products

  • Tornado Tornado before 6.6

Timeline

  • 2026-10-22: disclosed: GitHub Security Advisory published
  • 2026-11-08: advisory: CVE-2026-123535 and NVD entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.