CVE-2026-35536 Tornado has incomplete validation of cookie attributes
Attackers can inject crafted characters into cookie attributes in Tornado, potentially bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35536?
CVE-2026-35536 is a high-severity vulnerability in tornadoweb Tornado, published on 3 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.
Weakness: CWE-159
Which versions are affected by CVE-2026-35536?
5 open source packages ship an affected version, including tornado. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tornado PyPI | All versions | 6.5.5 |
tornado PyPI | All versions | 6.5.5 |
tornado PyPI | All versions | 6.5.5 |
tornado PyPI | All versions | 6.5.5 |
tornado PyPI | All versions | 6.5.5 |
Products include Tornadoweb Tornado.
How do I fix CVE-2026-35536?
Upgrade tornado to 6.5.5 or later.
Is CVE-2026-35536 being exploited?
There is no known exploitation of CVE-2026-35536 in the wild and no public exploit code.
Other vulnerabilities in tornadoweb Tornado
- CVE-2026-31958 Tornado has a DoS due to too many multipart parts
- CVE-2025-67725 Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing
- CVE-2025-67726 Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters
- CVE-2024-52804 Tornado has HTTP cookie parsing DoS vulnerability
- CVE-2014-9720 Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)
Sources
Also known as BELL-CVE-2026-35536, CLEANSTART-2026-GY87209, CLEANSTART-2026-MP46528, CLEANSTART-2026-UK29776, DEBIAN-CVE-2026-35536, ECHO-2021-f695-d29d and 15 more.