Red Hat Product Security issued an advisory (RHSA-2026:19189) for python-tornado in Red Hat Enterprise Linux 9 to address two vulnerabilities: CVE-2026-31958, a denial of service vulnerability triggered by large multipart bodies, and CVE-2026-35536, a cookie attribute injection vulnerability caused by improper handling of cookie arguments. These issues affect multiple architectures and variants of Red Hat Enterprise Linux 9. Updated python-tornado packages (version 6.5.5-1.el9_8) have been released to remediate these vulnerabilities. The advisory classifies the impact as moderate and provides package updates for various supported platforms.

The vulnerabilities could allow an attacker to cause a denial of service via large multipart bodies or inject cookie attributes improperly, potentially affecting application behavior relying on python-tornado. Red Hat rates the security impact as moderate. There are no reports of active exploitation in the wild.

Red Hat has released updated python-tornado packages that address these vulnerabilities. Users of affected Red Hat Enterprise Linux 9 versions should apply the available updates as described in the Red Hat advisory RHSA-2026:19189 and the referenced update article (https://access.redhat.com/articles/11258). Applying these official patches is the recommended remediation. No additional mitigation steps are indicated by the vendor advisory.