Python tornado: Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by… (CVE-2026-91991)

Tornado versions prior to 6.5.8 have an incomplete fix addressing cookie attribute injection. Attackers can exploit this by passing capitalized or legacy keyword arguments to the set_cookie method, embedding semicolon-delimited data in cookie attributes such as Domain, Path, or SameSite. This bypasses validation mechanisms and allows modification of cookie security attributes, potentially impacting confidentiality and integrity of cookie data.

The vulnerability allows attackers to inject arbitrary cookie attributes, which can lead to modification of cookie security settings. This may result in confidentiality and integrity impacts on cookie data, potentially enabling session manipulation or other attacks relying on cookie attributes. The CVSS score of 5.4 reflects a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and scope changed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability is fixed in Tornado 6.5.8, upgrading to version 6.5.8 or later is recommended once the vendor releases the fix. Until then, monitor vendor advisories for official patches or temporary mitigations.