CVE-2026-91991: Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tornadoto a version that resolves this vulnerability.Fixed in 6.5.8 - Compensating control
If you cannot upgrade immediately, ensure your application does not pass attacker-controlled values (including capitalized or legacy keyword arguments) to Tornado's RequestHandler.set_cookie so that cookie security attributes cannot be injected.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Tornado versions before 6.5.8 are exposed if they pass attacker-controlled data into capitalized or legacy keyword arguments of set_cookie, including parameters such as Domain, Path, or SameSite.
What does an attacker need to exploit it?
An attacker needs a way to influence values supplied to affected set_cookie keyword arguments. They can use semicolon-delimited data in capitalized parameters to inject and alter cookie attributes.
Is exploitation straightforward over the network?
The vector is network-accessible and requires no privileges or user interaction, but the listed attack complexity is high. Exploitation depends on the application exposing attacker control over the affected cookie-setting arguments.
How can I determine whether an application is affected?
Check whether it uses Tornado before 6.5.8 and review calls to set_cookie for capitalized or legacy keyword arguments, especially Domain, Path, and SameSite. Determine whether any values passed to those arguments can contain attacker-controlled semicolon-delimited input.