Executive brief
Tornado is a popular web framework and networking library for Python. A security flaw in how it handles web cookies allows attackers to inject unauthorized cookie attributes, which could lead to session manipulation or security policy bypasses. This could potentially allow an attacker to compromise user accounts or interfere with how a browser interacts with the website.
Technical details
A cookie attribute injection vulnerability exists in Tornado's RequestHandler.set_cookie method. The root cause is improper neutralization of special characters (specifically semicolons) within the 'domain', 'path', and 'samesite' arguments. An attacker who can influence these parameters can inject additional cookie attributes, potentially overriding security settings like 'HttpOnly' or 'Secure', or manipulating session behavior. This is reachable over the network without authentication, though it typically requires the application to pass user-controlled input into the affected cookie parameters. The issue is resolved in version 6.5.5.
Affected products
- tornadoweb Tornado < 6.5.5
Timeline
- 2026-03-10: patched: Fixed in version 6.5.5
- 2026-03-10: advisory: GitHub Security Advisory published
- 2026-04-03: disclosed: CVE published to NVD