GHSA-wwv5-g3v4-889x: Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`
The CVE-2026-35536 fix added a validation loop that rejects [\x00-\x20\x3b\x7f], but only for the
hardcoded lowercase keys name/domain/path/samesite. The still-live deprecated **kwargs path
writes attacker-supplied attribute values straight into the Morsel with no validation, and because
Morsel.__setitem__ is case-insensitive, a capitalized kwarg (Domain=, Path=, SameSite=, Max-Age=)
routes to the same reserved attribute while bypassing the loop — re-opening ;-delimited attribute injection.
self.set_cookie("sid", "abc", Domain="evil.com; Secure; SameSite=None")
References
- github.com/advisories/GHSA-wwv5-g3v4-889x
- github.com/tornadoweb/tornado/commit/6ef836e43e1278530041376adb32504daa977b91
- github.com/tornadoweb/tornado/commit/da284767eae8e1f0484f123b8c3225f6465b09c7
- github.com/tornadoweb/tornado/pull/3704
- github.com/tornadoweb/tornado/pull/3706
- github.com/tornadoweb/tornado/releases/tag/v6.5.8
- github.com/tornadoweb/tornado/security/advisories/GHSA-wwv5-g3v4-889x
Code Behaviors & Features
Detect and mitigate GHSA-wwv5-g3v4-889x with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →