The Red Hat Security Advisory RHSA-2026:13670 addresses two vulnerabilities in the python-tornado package for Red Hat Enterprise Linux 9. CVE-2026-31958 is a denial of service vulnerability caused by processing large multipart bodies. CVE-2026-35536 is a cookie attribute injection vulnerability resulting from improper handling of cookie arguments. Both issues have been fixed in the updated python-tornado packages version 6.5.5-1.el9_7.1. The advisory covers multiple architectures including x86_64, s390x, ppc64le, and aarch64. The vulnerabilities are rated as moderate in severity by Red Hat. The advisory provides package updates and instructions for remediation.

The vulnerabilities could allow an attacker to cause a denial of service via large multipart bodies or inject cookie attributes improperly, potentially affecting application behavior relying on python-tornado. The impact is rated moderate by Red Hat. There are no reports of known exploits in the wild at this time.

Red Hat has released updated python-tornado packages that fix these vulnerabilities. Users running affected versions of Red Hat Enterprise Linux 9 should apply the updates as described in Red Hat advisory RHSA-2026:13670 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor beyond applying the official update.