MEDIUM 5.4 PyPI
Tornado has incomplete validation of cookie attributes
GHSA-78cv-mqj4-43f7 · CVE-2026-35536 · GHSA-fqwm-6jpj-5wxc · PYSEC-2026-2287
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Values passed to the domain, path, and samesite arguments of RequestHandler.set_cookie were not completely validated in versions of Tornado prior to 6.5.5. In particular, semicolons would be allowed, which could be used to inject attacker-controlled values for other cookie attributes.
Ready to move
Start Securing
Free, no credit card | First findings in minutes