high 7.2

CVE-2026-35536 json

Tornado has incomplete validation of cookie attributes

published 2026-03-11 7 mo ago modified 2026-09-10 1 mo ago also GHSA-78cv-mqj4-43f7 , GHSA-fqwm-6jpj-5wxc , PYSEC-2026-2287 , EUVD-2026-18574

cvss: 7.2; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 15%
public exploits: 0; none known

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

Patch / fix

fixed in 2 distros 5 links 2

pypi tornado 6.5.5
tornadoweb Tornado 6.5.5

debian ubuntu red hat almalinux rocky linux

python-tornado Debian 14 6.5.5-1

debian advisories DEBIAN-CVE-2026-35536

python-tornado Ubuntu 24.04 LTS 6.4.0-1ubuntu0.5
python-tornado Ubuntu 25.10 6.4.2-3ubuntu0.3
python-tornado Ubuntu 26.04 LTS 6.5.4-0.1ubuntu0.1
python-tornado Ubuntu Pro 16.04 LTS 4.2.1-1ubuntu3.1+esm3
python-tornado Ubuntu Pro 18.04 LTS 4.5.3-1ubuntu0.2+esm3
python-tornado Ubuntu Pro 22.04 LTS 6.1.0-3ubuntu0.1~esm5

ubuntu advisories UBUNTU-CVE-2026-35536

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

python-tornado RHEL 9 6.5.5-1.el9_8
python3-tornado RHEL 9 6.5.5-1.el9_8
python-tornado RHEL 10.2 6.5.5-1.el10_2
python3-tornado RHEL 10.2 6.5.5-1.el10_2
python-tornado RHEL 9 6.5.5-1.el9_7.1
python3-tornado RHEL 9 6.5.5-1.el9_7.1
python-tornado RHEL 10.1 6.5.5-1.el10_1.1
python3-tornado RHEL 10.1 6.5.5-1.el10_1.1

red hat advisories RHSA-2026:24342 RHSA-2026:20810 RHSA-2026:20577 RHSA-2026:20573 RHSA-2026:20572 RHSA-2026:19189

python3-tornado AlmaLinux 10 6.5.5-1.el10_2
python3-tornado AlmaLinux 9 6.5.5-1.el9_8
python3-tornado AlmaLinux 10 6.5.5-1.el10_1.1
python3-tornado AlmaLinux 9 6.5.5-1.el9_7.1

almalinux advisories ALSA-2026:19034 ALSA-2026:19189 ALSA-2026:13641 ALSA-2026:13670

python-tornado Rocky Linux 10 6.5.5-1.el10_1.1
python-tornado Rocky Linux 9 6.5.5-1.el9_7.1

rocky linux advisories RLSA-2026:19034 RLSA-2026:19189 RLSA-2026:13641 RLSA-2026:13670

github.com/tornadoweb/tornado@24a2d96 commit
github.com/tornadoweb/tornado/releases/tag/v6.5.5 release

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-35536 updated 2026-11-07 cvss 5.4

tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments

Red Hat External Secrets Operator for Red Hat OpenShift external-secrets-operator/external-secrets-rhel9, external-secrets-operator/bitwarden-sdk-server-rhel9, external-secrets-operator/external-secrets-operator-rhel9, external-secrets-operator/external-secrets-operator-bundle Red Hat Lightspeed Core ansible-automation-platform-26/lightspeed-chatbot-rhel9, openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9
affected: no fix available
Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-ocp-rag-rhel9
affected: no fix planned “Will not fix”
Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/disk-image-cuda-rhel9 Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-9
affected: no fix available
Red Hat Enterprise Linux AppStream (v. 9) python-tornado 6.5.5-1.el9_8, python3-tornado 6.5.5-1.el9_8, python-tornado 6.5.5-1.el9_7.1, python3-tornado 6.5.5-1.el9_7.1
fixed: vendor fix RHSA-2026:13670
Red Hat Enterprise Linux AppStream (v. 10) python-tornado 6.5.5-1.el10_2, python3-tornado 6.5.5-1.el10_2, python-tornado 6.5.5-1.el10_1.1, python3-tornado 6.5.5-1.el10_1.1
fixed: vendor fix RHSA-2026:13641
Red Hat Enterprise Linux AppStream E4S (v.9.2) python-tornado 6.4.2-1.el9_2.2, python3-tornado 6.4.2-1.el9_2.2
fixed: vendor fix RHSA-2026:20573
Red Hat Enterprise Linux AppStream EUS (v. 10.0) python-tornado 6.4.2-1.el10_0.2, python3-tornado 6.4.2-1.el10_0.2
fixed: vendor fix RHSA-2026:20577
Red Hat Enterprise Linux AppStream EUS (v.9.4) python-tornado 6.4.2-1.el9_4.2, python3-tornado 6.4.2-1.el9_4.2
fixed: vendor fix RHSA-2026:20810

show 8 more

Red Hat Enterprise Linux AppStream EUS (v.9.6) python-tornado 6.4.2-2.el9_6.3, python3-tornado 6.4.2-2.el9_6.3
fixed: vendor fix RHSA-2026:20572
Red Hat Enterprise Linux Server Optional (v. 7 ELS) python-tornado 4.2.1-5.el7_9.3
fixed: vendor fix RHSA-2026:24342
Red Hat OpenShift AI 2.25 rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9 1787815645, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 1787292256, rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 1787652771, rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9 1788185839, rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9 1788185798, rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9 1788185733, +12 more
fixed: vendor fix RHSA-2026:65126
Red Hat OpenShift AI 3.3 rhoai/odh-llama-stack-core-rhel9 1782471587, rhoai/odh-trustyai-nemo-guardrails-server-rhel9 1782471606, rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9 1790331344, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 1789651383, rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 1789651379, rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9 1790260954, +14 more
fixed: vendor fix RHSA-2026:37275
Red Hat Enterprise Linux 8 pcs, pcs-snmp Red Hat Enterprise Linux 9 pcs, pcs-snmp
not affected: vulnerable code cannot be controlled by adversary
Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9/odh-mlflow-rhel9
not affected: component not present
Red Hat OpenShift AI 2.25 rhoai/odh-rhel9-operator 1788331391, rhoai/odh-vllm-cpu-rhel9 1786712073, rhoai/odh-dashboard-rhel9 1788312226, rhoai/odh-modelmesh-rhel9 1788319539, rhoai/odh-operator-bundle 1788332816, rhoai/odh-vllm-cuda-rhel9 1786710989, +53 more Red Hat OpenShift AI 3.3 rhoai/odh-cli-rhel9 1782471642, rhoai/odh-cli-rhel9 1790070206, rhoai/rhai-cli-rhel9 1782471642, rhoai/rhai-cli-rhel9 1790070206, rhoai/odh-mlflow-rhel9 1782917849, rhoai/odh-mlflow-rhel9 1789653606, +140 more
not affected: vulnerable code not present
Red Hat OpenShift Container Platform 4 python-pep517, python-tornado
not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 7 mo ago (2026-04-03)

Exploit prediction

0.25% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
NVD	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
GitHub	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
OSV	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
GitHub	3.1	7.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
pypi	tornado	<6.5.5	6.5.5

Affected products

tornadoweb Tornado

Classification

Weakness

CWE-159 Improper Handling of Invalid Use of Special Elements
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component

References

github.com /tornadoweb/tornado/commit/24a2d96ea115f663b223887deb0060f13974c104
web
github.com /tornadoweb/tornado/security/advisories/GHSA-78cv-mqj4-43f7
web, vendor-advisory, advisory
github.com /tornadoweb/tornado/releases/tag/v6.5.5
web, product
github.com /tornadoweb/tornado
package
nvd.nist.gov /vuln/detail/CVE-2026-35536
advisory
github.com /advisories/GHSA-fqwm-6jpj-5wxc
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary