HIGH SeverityCVSS 3.17.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVE-2026-35536
Last updated Apr 03, 2026 · Published Apr 03, 2026
Description
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.
Affected products
1 listed- tornadoweb:Tornado
Mappings
CWE
CWE-159
CAPEC
None listed.
CVE® content © MITRE Corporation. Licensed under the CVE Terms of Use. Terms