PT-2026-139816

Tornado before 6.6 does not validate the max age argument of RequestHandler.set cookie also called by set signed cookie, set secure cookie, and clear cookie, allowing injection of additional Set-Cookie attributes. When an application passes attacker-influenced input as max age, an attacker can...