Search: CVE-2026-35536

CVE-2026-35536 is a high-severity vulnerability in Tornado versions before 6.5.5 where improper validation of cookie attributes (domain, path, samesite) in the set_cookie method can lead to cookie attribute injection. This occurs because these arguments are not checked for crafted characters, potentially allowing an attacker to manipulate cookie behavior. The vulnerability has a CVSS score of 7.2, indicating significant impact on confidentiality and integrity with no required privileges or user interaction. No official patch or remediation details are provided in the available data, and no known exploits are reported in the wild.