CVE-2026-123535 Details
Description
Tornado before 6.6 does not validate the max_age argument of RequestHandler.set_cookie (also called by set_signed_cookie, set_secure_cookie, and clear_cookie), allowing injection of additional Set-Cookie attributes. When an application passes attacker-influenced input as max_age, an attacker can embed attributes such as Domain, Path, or Secure to widen the cookie's scope to parent paths or other subdomains.
A vulnerability exists in Tornado versions prior to 6.6, where the max_age argument of the RequestHandler.set_cookie method is not properly validated. This oversight allows for the injection of additional Set-Cookie attributes. When an application uses untrusted input for max_age without converting it to an integer, an attacker can manipulate cookie attributes such as Domain, Path, or Secure. This could potentially expand the cookie's scope to parent paths or other subdomains.
Users can upgrade to Tornado version 6.6.0 or later, where this vulnerability has been fixed. Alternatively, if using an earlier version, ensure that the max_age argument is converted to an integer before being passed to the set_cookie method.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tornado | >= 0, < 6.6 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 8, 2026 | New CVE Received | [email protected] |