CVE-2026-35536

What it actually does

The vulnerability allows for cookie attribute injection because the `domain`, `path`, and `samesite` parameters of the `set_cookie` method in Tornado's `RequestHandler` do not properly sanitize input. An attacker can inject characters like semicolons to add or modify cookie attributes in the `Set-Cookie` HTTP response header. This can lead to security bypasses by allowing an attacker to set cookies for a broader domain or path than intended, a technique known as 'cookie tossing'. This could override legitimate application cookies, leading to session fixation or information disclosure.

Why it matters to the business

Exploitation of this vulnerability could allow attackers to hijack user sessions, leading to unauthorized access to accounts and sensitive data. This undermines user trust and can result in regulatory fines and reputational damage. Since Tornado is a web framework, a single vulnerable instance could expose multiple applications, widening the potential blast radius of an attack. The impact is primarily on data confidentiality and integrity from the user's perspective.

How an attack unfolds

A remote, unauthenticated attacker first identifies an application built with a vulnerable version of Tornado. They must then find a feature where user-controlled input is passed to the `domain`, `path`, or `samesite` parameter of a cookie-setting function. For example, if a subdomain is set based on a URL parameter, an attacker could provide a crafted value like `sub.example.com; Domain=example.com`. The vulnerable server would then generate a `Set-Cookie` header containing two `Domain` attributes. Depending on browser parsing behavior, the malicious, broader domain could take precedence, allowing the attacker to 'toss' a cookie into a parent domain. This could be used to overwrite a legitimate session cookie, effectively fixing a user's session to one controlled by the attacker.

How to fix it

Upgrade the Tornado framework to version 6.5.5 or later. This version includes the necessary input validation to prevent cookie attribute injection. If an immediate upgrade is not feasible, implement a temporary mitigation by ensuring that any user-provided data passed to the `domain`, `path`, or `samesite` arguments of the `RequestHandler.set_cookie` method is strictly validated to disallow characters such as semicolons, commas, and newlines.

How to confirm the fix worked

To confirm remediation, verify that the Tornado package installed in your application environments is version 6.5.5 or newer. Use package management tools like `pip show tornado` or inspect dependency manifests (`requirements.txt`, `Pipfile.lock`). To test for exposure, conduct a code review or use a SAST tool to find all calls to `set_cookie` and trace the origin of its parameters. If any parameter is derived from external input without sanitization, the application is vulnerable on unpatched versions. DAST tools can also be configured to inject semicolons into relevant inputs and check for malformed `Set-Cookie` headers in the response.

Typical attack path

1. An attacker discovers a public-facing web application using a vulnerable version of the Tornado framework.
2. The attacker identifies an input vector where user-supplied data is used to construct the domain, path, or samesite attribute of a cookie.
3. The attacker crafts a malicious request containing special characters (e.g., a semicolon) in the identified input field to inject a new cookie attribute.
4. The vulnerable server sends a malformed `Set-Cookie` header to the victim's browser.
5. The victim's browser parses the header and incorrectly applies the cookie to a different scope (e.g., a parent domain).
6. The attacker leverages the misplaced cookie to conduct further attacks, such as session hijacking or bypassing security controls.

How to detect it

To detect potential exploitation attempts, monitor web server access logs and application logs for unusual requests where parameters known to influence cookie attributes contain special characters like semicolons. On the network level, inspect outgoing HTTP responses for `Set-Cookie` headers that are malformed, such as containing multiple `Domain=`, `Path=`, or `SameSite=` attributes within a single header. A Web Application Firewall (WAF) may be configured with custom rules to detect and block responses containing such headers.

• http.response.header.content contains 'Set-Cookie: .*domain=.*domain='
• http.response.header.content contains 'Set-Cookie: .*path=.*path='
• http.response.header.content contains 'Set-Cookie: .*samesite=.*samesite='
• http.response.header.content contains 'Set-Cookie: .*expires=.*expires='
• http.request.uri contains ';domain='
• http.request.uri contains ';path='
• http.request.uri contains ';samesite='

What your security team should do

• Immediately prioritize upgrading all applications using the Tornado framework to version 6.5.5 or newer to fully resolve the vulnerability.
• Utilize a Software Composition Analysis (SCA) tool to scan your organization's codebases and build artifacts to identify all instances of the vulnerable Tornado library.
• If patching must be delayed, instruct development teams to review all `set_cookie` calls and apply strict input validation on parameters influenced by user input as a compensating control.