REDHAT-BUG-2454716: Medium severity pypi/tornado vulnerability
Published Apr 3, 2026
·Updated
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.setcookie were not checked for crafted characters.
Affected Software
1 affected component
pypi/tornado<6.5.5
Event History
Apr 3, 2026
Data Sourced
via Red Hat·04:01 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of REDHAT-BUG-2454716?
The severity of REDHAT-BUG-2454716 is medium with a score of 4.
2
What does REDHAT-BUG-2454716 describe?
REDHAT-BUG-2454716 describes a cookie attribute injection vulnerability in Tornado before version 6.5.5.
3
How do I fix REDHAT-BUG-2454716?
To fix REDHAT-BUG-2454716, upgrade to Tornado version 6.5.5 or later.
4
What could be exploited in REDHAT-BUG-2454716?
In REDHAT-BUG-2454716, crafted characters in domain, path, and samesite arguments to .RequestHandler.set_cookie could be exploited.
5
Which software is affected by REDHAT-BUG-2454716?
The affected software in REDHAT-BUG-2454716 is the pypi/tornado package.