This vulnerability in Tornado before version 6.5.5 involves improper handling of invalid input in the set_cookie method of RequestHandler. Specifically, the domain, path, and samesite parameters are not validated for maliciously crafted characters, leading to cookie attribute injection (CWE-159). This can allow an attacker to alter cookie attributes, potentially affecting cookie security properties and session management. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, no privileges or user interaction required, with a scope change and partial confidentiality and integrity impact.

The vulnerability allows an attacker to inject crafted characters into cookie attributes, which can lead to manipulation of cookie behavior. This may compromise confidentiality and integrity of user sessions or application data relying on cookies. There is no indication of availability impact. No known exploits have been reported in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects Tornado versions before 6.5.5, upgrading to version 6.5.5 or later is likely recommended once official guidance is available. Until then, avoid using untrusted input in cookie attribute parameters or implement manual validation to sanitize these inputs.