Red Hat Product Security issued an advisory for python-tornado in Red Hat Enterprise Linux 10 addressing two vulnerabilities: CVE-2026-31958, a denial of service via large multipart bodies, and CVE-2026-35536, a cookie attribute injection due to improper handling of cookie arguments. The advisory references updated packages (python-tornado-6.5.5-1.el10_1.1) that fix these vulnerabilities. The advisory rates the security impact as moderate and provides detailed package information for multiple architectures and extended support versions. No CVSS score is provided in the advisory, but the vulnerabilities are acknowledged and fixed in the updated package.

The denial of service vulnerability (CVE-2026-31958) could allow an attacker to disrupt service by sending large multipart bodies. The cookie attribute injection vulnerability (CVE-2026-35536) could lead to improper cookie handling, potentially affecting security controls relying on cookie attributes. Both vulnerabilities have a moderate security impact as rated by Red Hat. There are no known exploits in the wild at the time of the advisory.

Red Hat has released an updated python-tornado package version 6.5.5-1.el10_1.1 for Red Hat Enterprise Linux 10 and its variants that addresses these vulnerabilities. Users should apply this official update as per Red Hat's instructions in https://access.redhat.com/articles/11258 to remediate the issues. No additional mitigation steps are indicated by the vendor advisory.