In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.setcookie were not checked for crafted characters...
7.2CVSS6.2AI score0.00287EPSS
SaveExploits0References3
UbuntuCve•added 2026/04/03 4:16 a.m.•11 views
CVE-2026-35536
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.setcookie were not checked for crafted characters...
