CVE-2026-91991
Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs
- State
- Published
- Severity
- 6.3 Medium
- Published
- Sep 15, 2026
- Updated
- Oct 8, 2026
- Reserved
- Sep 15, 2026
Description
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.3 Medium | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Affected Products
| Product | Versions |
|---|---|
tornadotornadoweb |
|
References
- GitHub Security Advisory (GHSA-wwv5-g3v4-889x)vendor-advisory
- VulnCheck Advisory: Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.