{"id":"CVE-2026-123535","kind":"vulnerability","aliases":["CVE-2026-123535"],"related":[],"title":"Tornado: unvalidated max_age lets attackers inject cookie attributes","description":"Tornado before 6.6 does not validate the max_age argument of RequestHandler.set_cookie (also called by set_signed_cookie, set_secure_cookie, and clear_cookie), allowing injection of additional Set-Cookie attributes. When an application passes attacker-influenced input as max_age, an attacker can embed attributes such as Domain, Path, or Secure to widen the cookie's scope to parent paths or other subdomains.","summary":"Tornado before 6.6 does not validate the max_age argument of its cookie-setting methods, so attacker-influenced input can add extra Set-Cookie attributes. An attacker can use this to widen a cookie's scope to parent paths or other subdomains.","severity":"medium","cvss":4.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","python","tornado","web-apps"],"not_affected_if":["hard-coded-max-age","no-user-input-in-cookies"],"how_to_check":"- Check the installed Tornado version with `pip show tornado` or `python -c \"import tornado; print(tornado.version)\"`.\n- Search application code for calls to `set_cookie`, `set_signed_cookie`, `set_secure_cookie` or `clear_cookie` where `max_age` comes from request data.","fix":"- Tornado: move to `6.6` or later.","status":"open","published_at":"2026-11-08T02:16:43+00:00","first_seen_at":"2026-11-08T02:21:10+00:00","triaged_at":"2026-11-08T02:25:35+00:00","updated_at":"2026-11-08T02:25:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:25:35Z","model":"claude-haiku-5-5","output":{"fix":"- Tornado: move to `6.6` or later.","reach":"internet","title":"Tornado: unvalidated max_age lets attackers inject cookie attributes","impact":"medium","summary":"Tornado before 6.6 does not validate the max_age argument of its cookie-setting methods, so attacker-influenced input can add extra Set-Cookie attributes. An attacker can use this to widen a cookie's scope to parent paths or other subdomains.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","tornado","web-apps"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker widens cookie scope to other subdomains or paths","analyst_note":"","how_to_check":"- Check the installed Tornado version with `pip show tornado` or `python -c \"import tornado; print(tornado.version)\"`.\n- Search application code for calls to `set_cookie`, `set_signed_cookie`, `set_secure_cookie` or `clear_cookie` where `max_age` comes from request data.","plain_action":"","needs_analyst":false,"not_affected_if":["hard-coded-max-age","no-user-input-in-cookies"],"who_is_affected":"Only applications built on Tornado that pass attacker-influenced values into the max_age argument of cookie methods are exposed. Apps that hard-code max_age or never take it from user input are not affected by this flaw.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000698,"input_tokens":4310,"output_tokens":534,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123535':12A,15A '-2026':11A,14A '6.6':24B,69C 'add':44B 'addit':95C 'age':4A,30B,75C,110C 'allow':92C 'also':80C 'app':21B 'applic':102C 'argument':31B,76C 'attack':6A,40B,51B,105C,112C 'attacker-influenc':39B,104C 'attribut':9A,49B,99C,115C 'call':81C 'clear':90C 'cooki':8A,35B,48B,58B,79C,85C,88C,91C,98C,125C 'cookie-set':34B 'cve':10A,13A 'domain':118C 'emb':114C 'extra':45B 'influenc':41B,106C 'inject':7A,93C 'input':42B,107C 'let':5A 'max':3A,29B,74C,109C 'method':37B 'packag':16B 'parent':62B,129C 'pass':103C 'path':63B,119C,130C 'python':17B 'requesthandler.set':78C 'scope':60B,127C 'secur':87C,121C 'set':36B,47B,83C,86C,97C 'set-cooki':46B,96C 'sign':84C 'subdomain':66B,133C 'tornado':1A,18B,22B,67C 'unvalid':2A 'use':53B 'valid':27B,72C 'web':20B 'web-app':19B 'widen':56B,123C","nicknames":[],"mitigations":[],"who_affected":"Only applications built on Tornado that pass attacker-influenced values into the max_age argument of cookie methods are exposed. Apps that hard-code max_age or never take it from user input are not affected by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","python","tornado","webapps"],"campaign_type":null,"search_a":"'-123535':12A,15A '-2026':11A,14A 'age':4A 'attack':6A 'attribut':9A 'cooki':8A 'cve':10A,13A 'inject':7A 'let':5A 'max':3A 'tornado':1A 'unvalid':2A","search_b":"'6.6':24B 'add':44B 'age':30B 'app':21B 'argument':31B 'attack':40B,51B 'attacker-influenc':39B 'attribut':49B 'cooki':35B,48B,58B 'cookie-set':34B 'extra':45B 'influenc':41B 'input':42B 'max':29B 'method':37B 'packag':16B 'parent':62B 'path':63B 'python':17B 'scope':60B 'set':36B,47B 'set-cooki':46B 'subdomain':66B 'tornado':18B,22B 'use':53B 'valid':27B 'web':20B 'web-app':19B 'widen':56B","search_c":"'6.6':69C 'addit':95C 'age':75C,110C 'allow':92C 'also':80C 'applic':102C 'argument':76C 'attack':105C,112C 'attacker-influenc':104C 'attribut':99C,115C 'call':81C 'clear':90C 'cooki':79C,85C,88C,91C,98C,125C 'domain':118C 'emb':114C 'influenc':106C 'inject':93C 'input':107C 'max':74C,109C 'parent':129C 'pass':103C 'path':119C,130C 'requesthandler.set':78C 'scope':127C 'secur':87C,121C 'set':83C,86C,97C 'set-cooki':96C 'sign':84C 'subdomain':133C 'tornado':67C 'valid':72C 'widen':123C","first_public_at":"2026-10-22T13:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123535","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123535","severity":null,"published_at":"2026-11-08T02:16:43+00:00","modified_at":"2026-11-08T02:16:44+00:00","first_seen_at":"2026-11-08T02:21:10+00:00","fetched_at":"2026-11-08T02:21:10+00:00","note":null}],"documents":[{"id":99219,"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-c6v4-qj2h-f748","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T13:16:52+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99220,"url":"https://www.vulncheck.com/advisories/tornado-before-6.6-cookie-attribute-injection-via-set-cookie-max-age","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}