CVE-2026-123535

Tornado before 6.6 does not validate the maxage argument of RequestHandler.setcookie also called by setsignedcookie, setsecurecookie, and clearcookie, allowing injection of additional Set-Cookie attributes. When an application passes attacker-influenced input as maxage, an attacker can embed...