The Tornado Python web server and tools had two security issues: CVE-2026-31958, where large multipart request bodies were incorrectly parsed, potentially causing denial of service; and CVE-2026-35536, where cookie values were not properly validated, allowing injection of arbitrary cookie attributes. These vulnerabilities affect various versions of python-tornado packages across multiple Ubuntu LTS releases and Red Hat Enterprise Linux. Vendor advisories from Ubuntu confirm that patches are available and recommend updating to fixed package versions. The issues are tracked under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-88 (Argument Injection or Modification).

An attacker could exploit CVE-2026-31958 to cause a denial of service by sending large multipart request bodies that Tornado mishandles. For CVE-2026-35536, an attacker could inject arbitrary cookie attributes due to improper validation, which might affect application behavior relying on cookie integrity. No known exploits in the wild have been reported. The impact is considered medium severity.

Fixes for these vulnerabilities are available and can be applied via standard system updates for supported Ubuntu releases and Red Hat packages. Ubuntu Pro users can obtain fixes through Extended Security Maintenance (ESM). It is recommended to update python-tornado packages to the versions specified in the Ubuntu security notices USN-8198-1 and USN-8198-2. No additional mitigation beyond applying these updates is indicated by the vendor advisories.