Executive brief
Tornado's set_cookie() function contains a vulnerability in how it processes cookie attributes passed as capitalized keyword arguments (e.g., Domain= instead of domain=). A patch for an earlier cookie-injection flaw (CVE-2026-35536) blocked injection in the standard lowercase parameters but missed the legacy kwargs path, allowing attackers to inject semicolon-delimited attributes and manipulate cookie properties like Secure, HttpOnly, and SameSite flags or rebind Domain/Path values.
Technical details
The vulnerability is a case-insensitive keyword argument injection in tornado/web.py's RequestHandler.set_cookie() method. The CVE-2026-35536 fix added validation rejecting characters [\\x00-\\x20\\x3b\\x7f] (including semicolons) but only for hardcoded lowercase parameter names (name, domain, path, samesite). The deprecated **kwargs path bypasses this validation because Python's Morsel.__setitem__ is case-insensitive; passing Domain="evil.com; Secure; SameSite=None" (capitalized) routes to the same reserved attribute as domain= but skips the validation loop. An attacker can inject independent cookie attributes, force or drop security flags (Secure, HttpOnly, SameSite), or rebind Domain/Path—the same impact as CVE-2026-35536. The vulnerability is conditional on the application using capitalized or legacy keyword arguments. The regression test only exercises lowercase named parameters, not capitalized kwargs.
Affected products
- Tornadoweb Tornado >= 6.5.5, < 6.5.8
Timeline
- 2026-08-07: disclosed
- 2026-09-01: patched: Version 6.5.8 released with fix
- 2026-09-01: advisory: GitHub advisory published