UBUNTU-CVE-2026-123535: Low severity ubuntu/python-tornado vulnerability
Tornado before 6.6 does not validate the maxage argument of RequestHandler.setcookie (also called by setsignedcookie, setsecurecookie, and clearcookie), allowing injection of additional Set-Cookie attributes. When an application passes attacker-influenced input as maxage, an attacker can embed attributes such as Domain, Path, or Secure to widen the cookie's scope to parent paths or other subdomains.
Affected Software
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications using Tornado before 6.6 are exposed only if they pass attacker-influenced input to the max_age argument of RequestHandler.set_cookie or its related set_signed_cookie, set_secure_cookie, or clear_cookie methods.
What does an attacker need to exploit it?
An attacker must be able to influence the max_age value used when the application sets or clears a cookie. Exploitation also requires user interaction.
What is the impact of a successful exploit?
The attacker can inject additional Set-Cookie attributes, including Domain, Path, or Secure. This can widen a cookie's scope to parent paths or other subdomains.
How can teams assess whether they are affected?
Check whether the deployed Tornado version is earlier than 6.6, then review calls to the affected cookie methods for max_age values derived from request data or other attacker-controlled input.