Tornado CVE-2026-35536

Requires Tornado web framework versions before 6.5.5. Attacker exploits application code that calls RequestHandler.set_cookie() with unsanitized user-controlled input in domain, path, or samesite parameters. Remote unauthenticated exploitation; no victim interaction needed.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) indicates network-accessible exploitation with low complexity, requiring no authentication or user interaction, with scope change and low confidentiality/integrity impact. The Changed Scope (S:C) is particularly significant, suggesting the vulnerability can affect resources beyond the vulnerable component's security scope. However, real-world risk is moderated by several factors: the attack requires the application to accept attacker-controlled input into cookie parameters (domain/path/samesite arguments), which is uncommon in typical Tornado usage patterns where these are usually hard-coded by developers. The lack of CISA KEV listing and public exploit code suggests limited observed exploitation. SSVC assessment would likely classify this as having Technical Impact of Partial (limited confidentiality/integrity), not Automatable in most scenarios (requires application-specific logic), making it a medium-priority patch candidate rather than an emergency. Organizations using Tornado in environments where cookie parameters are dynamically generated from user input face elevated risk.

An attacker identifies a Tornado-based web application where user input influences cookie parameters, such as a multi-tenant system accepting subdomain values for cookie scoping. The attacker crafts a malicious domain parameter containing semicolon-delimited cookie attributes (e.g., 'example.com; HttpOnly=false; SameSite=None') and submits it through the application's cookie configuration endpoint. The unsanitized input is passed to RequestHandler.set_cookie, resulting in HTTP response headers with injected cookie directives that weaken security protections. The attacker can then leverage weakened SameSite or missing Secure flags to facilitate CSRF attacks or session hijacking over unencrypted connections, achieving limited confidentiality and integrity compromise across the application's security boundary.