| Name | CVE-2026-123535 |
| Description | Tornado before 6.6 does not validate the max_age argument of RequestHandler.set_cookie (also called by set_signed_cookie, set_secure_cookie, and clear_cookie), allowing injection of additional Set-Cookie attributes. When an application passes attacker-influenced input as max_age, an attacker can embed attributes such as Domain, Path, or Secure to widen the cookie's scope to parent paths or other subdomains. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| python-tornado (PTS) | bookworm, bookworm (security) | 6.2.0-3+deb12u4 | vulnerable |
| trixie (security), trixie | 6.4.2-3+deb13u2 | vulnerable | |
| forky | 6.5.5-5 | vulnerable | |
| sid | 6.6.0-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| python-tornado | source | (unstable) | 6.6.0-1 |
https://github.com/tornadoweb/tornado/security/advisories/GHSA-c6v4-qj2h-f748
https://github.com/tornadoweb/tornado/pull/3763
Fixed by: https://github.com/tornadoweb/tornado/commit/ab4953f1262636343bcc1875117f7a8c93d10509 (v6.6.0b1)
Fixed by: https://github.com/tornadoweb/tornado/commit/1fefc3d3df5146a087a2a879424adaed94f35827 (v6.6.0b1)
Fixed by: https://github.com/tornadoweb/tornado/commit/fb398638efcf023d09282989184c4f97c64982ca (v6.6.0b1)