CVE-2026-91991 Details
Description
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.
A vulnerability in Tornado versions 6.5.5 prior to 6.5.8 allows for cookie attribute injection. This issue arises from an incomplete fix for a previous vulnerability, CVE-2026-35536, which left a deprecated keyword argument path in the 'set_cookie' method unaddressed. Attackers can exploit this by sending capitalized or legacy keyword arguments, embedding semicolon-delimited data to bypass validation and manipulate cookie security attributes such as 'Domain', 'Path', and 'SameSite'.
To address this vulnerability, the same validation applied to lowercase keyword arguments should be extended to capitalized ones, or the deprecated keyword argument path should be removed altogether. Additionally, a regression test should be added to cover this exploitation vector.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tornadoweb/tornado/security/advisories/GHSA-wwv5-g3v4-889x | CISA-ADP | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/tornadoweb/tornado/security/advisories/GHSA-wwv5-g3v4-889x | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/tornado-before-6.5.8-cookie-attribute-injection-via-capitalized-kwargs | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tornado | >= 6.5.5, < 6.5.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |