The Red Hat security advisory RHSA-2026:20810 addresses two vulnerabilities in the python-tornado package. CVE-2026-31958 is a denial of service vulnerability triggered by processing large multipart bodies. CVE-2026-35536 is a cookie attribute injection vulnerability caused by improper handling of cookie arguments. These vulnerabilities affect python-tornado versions included in Red Hat Enterprise Linux 9.4 Extended Update Support and related variants. Red Hat has released updated python-tornado packages (version 6.4.2-1.el9_4.2) that fix these issues. The advisory rates the security impact as moderate and provides package updates for multiple architectures including x86_64, s390x, ppc64le, and aarch64. No known exploits in the wild are reported. The advisory references Red Hat's update article for applying the fixes.

The denial of service vulnerability (CVE-2026-31958) could allow an attacker to disrupt service by sending large multipart bodies to the Tornado server. The cookie attribute injection vulnerability (CVE-2026-35536) could allow injection of unintended cookie attributes due to improper argument handling, potentially affecting cookie security properties. Both vulnerabilities have a moderate security impact as rated by Red Hat. There are no reports of active exploitation in the wild.

Red Hat has released updated python-tornado packages (version 6.4.2-1.el9_4.2) that address these vulnerabilities. Users of Red Hat Enterprise Linux 9.4 and related variants should apply the available security updates as described in Red Hat advisory RHSA-2026:20810 and the update article at https://access.redhat.com/articles/11258. Applying these updates will remediate the denial of service and cookie attribute injection issues. No additional mitigation steps are indicated by the vendor.