Red Hat Product Security issued an advisory (RHSA-2026:20810) for python-tornado in Red Hat Enterprise Linux 9.4 addressing two vulnerabilities: CVE-2026-31958, a denial of service vulnerability caused by processing large multipart bodies, and CVE-2026-35536, a cookie attribute injection vulnerability due to improper handling of cookie arguments. The advisory provides updated package versions to fix these issues. The vulnerabilities are rated with moderate impact and affect multiple architectures supported by Red Hat Enterprise Linux 9.4. No CVSS scores are provided in the advisory, but the severity is classified as moderate.

The vulnerabilities could allow an attacker to cause a denial of service by sending large multipart bodies to the Tornado server (CVE-2026-31958) or to inject cookie attributes improperly due to incorrect handling of cookie arguments (CVE-2026-35536). These issues may affect the reliability and security of applications using python-tornado on affected Red Hat Enterprise Linux 9.4 systems. No known exploits have been reported in the wild at this time.

Red Hat has released updated python-tornado packages for Red Hat Enterprise Linux 9.4 that address these vulnerabilities. Users should apply these official updates as described in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate the issues. Since this is an official fix, applying the update fully mitigates the vulnerabilities. No additional mitigation steps are indicated by the vendor.