This advisory covers two vulnerabilities in the python-tornado package distributed with Red Hat Enterprise Linux 9.6 Extended Update Support. CVE-2026-31958 is a denial of service vulnerability caused by processing large multipart bodies. CVE-2026-35536 is a cookie attribute injection vulnerability resulting from improper handling of cookie arguments. Red Hat has issued updated python-tornado packages (version 6.4.2-2.el9_6.3) that address these vulnerabilities. The advisory references bugzilla entries BZ-2446765 and BZ-2454716 for the respective CVEs. The vulnerabilities are rated as moderate in severity by Red Hat Product Security. No evidence of exploitation in the wild is reported.

Successful exploitation of CVE-2026-31958 could allow an attacker to cause a denial of service condition by sending large multipart bodies to the Tornado server. CVE-2026-35536 could enable an attacker to inject cookie attributes due to improper handling of cookie arguments, potentially affecting cookie security and behavior. Both vulnerabilities could impact applications using the affected python-tornado versions on Red Hat Enterprise Linux 9.6 Extended Update Support. The overall security impact is considered moderate.

Red Hat has released updated python-tornado packages (version 6.4.2-2.el9_6.3) that fix these vulnerabilities. Users of Red Hat Enterprise Linux 9.6 Extended Update Support should apply the available security update as described in the Red Hat advisory RHSA-2026:20572 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor beyond applying the official update.