The python-tornado package in Red Hat Enterprise Linux 9 contains two vulnerabilities: CVE-2026-31958, which allows denial of service via large multipart bodies, and CVE-2026-35536, which permits cookie attribute injection due to improper cookie argument handling. These vulnerabilities could affect applications relying on Tornado for web services. Red Hat Product Security has released updated python-tornado packages (version 6.5.5-1.el9_8) to fix these issues. The advisory covers multiple architectures and variants of Red Hat Enterprise Linux 9. No CVSS scores are provided in the advisory, but the impact is rated moderate.

The denial of service vulnerability (CVE-2026-31958) could allow an attacker to disrupt service by sending large multipart bodies. The cookie attribute injection vulnerability (CVE-2026-35536) could lead to improper cookie handling, potentially affecting security controls relying on cookie attributes. Both vulnerabilities impact the python-tornado package used in Red Hat Enterprise Linux 9. No known exploits in the wild have been reported at this time.

Red Hat has released updated python-tornado packages (version 6.5.5-1.el9_8) that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:19189 and the referenced article https://access.redhat.com/articles/11258. Applying this update will remediate the denial of service and cookie attribute injection issues. No additional mitigation steps are indicated by the vendor.