CVE-2026-35536: Improper Handling of Invalid Use of Special Elements

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.setcookie were not checked for crafted characters...