Search: CVE-2026-91991

Tornado versions from 6.5.5 up to but not including 6.5.8 contain an incomplete fix for cookie attribute injection. This vulnerability allows attackers to inject arbitrary cookie attributes by using capitalized or legacy keyword arguments in the set_cookie function. By embedding semicolon-delimited data in parameters such as Domain, Path, or SameSite, attackers can bypass validation and alter cookie security attributes. The issue is classified as an HTTP request/response splitting vulnerability related to improper neutralization of CRLF sequences in HTTP headers.