CVE-2026-123535 · Package
NO FIX YET · SEE WHAT TO DO
Tornado before 6.6 does not validate the max_age argument of its cookie-setting methods, so attacker-influenced input can add extra Set-Cookie attributes. An attacker can use this to widen a cookie's scope to parent paths or other subdomains.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only applications built on Tornado that pass attacker-influenced values into the max_age argument of cookie methods are exposed. Apps that hard-code max_age or never take it from user input are not affected by this flaw.
Not affected if hard-coded-max-age, no-user-input-in-cookies
Who cares python, tornado, web-apps
pip show tornado or python -c "import tornado; print(tornado.version)".set_cookie, set_signed_cookie, set_secure_cookie or clear_cookie where max_age comes from request data.6.6 or later.Tornado before 6.6 does not validate the max_age argument of RequestHandler.set_cookie (also called by set_signed_cookie, set_secure_cookie, and clear_cookie), allowing injection of additional Set-Cookie attributes. When an application passes attacker-influenced input as max_age, an attacker can embed attributes such as Domain, Path, or Secure to widen the cookie's scope to parent paths or other subdomains.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.