GHSA-wwv5-g3v4-889x: Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`
The CVE-2026-35536 fix added a validation loop that rejects [\x00-\x20\x3b\x7f], but only for the
hardcoded lowercase keys name/domain/path/samesite. The still-live deprecated **kwargs path
writes attacker-supplied attribute values straight into the Morsel with no validation, and because
Morsel.__setitem__ is case-insensitive, a capitalized kwarg (Domain=, Path=, SameSite=, Max-Age=)
routes to the same reserved attribute while bypassing the loop — re-opening ;-delimited attribute injection.
self.set_cookie("sid", "abc", Domain="evil.com; Secure; SameSite=None")
References
- github.com/advisories/GHSA-wwv5-g3v4-889x
- github.com/tornadoweb/tornado/commit/6ef836e43e1278530041376adb32504daa977b91
- github.com/tornadoweb/tornado/commit/da284767eae8e1f0484f123b8c3225f6465b09c7
- github.com/tornadoweb/tornado/pull/3704
- github.com/tornadoweb/tornado/pull/3706
- github.com/tornadoweb/tornado/releases/tag/v6.5.8
- github.com/tornadoweb/tornado/security/advisories/GHSA-wwv5-g3v4-889x
Code Behaviors & Features
Detect and mitigate GHSA-wwv5-g3v4-889x with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →