In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.setcookie were not checked for crafted characters...
7.2CVSS5.9AI score0.00237EPSS
SaveExploits0References3
UbuntuCve•added 2026/04/03 4:16 a.m.•5 views
CVE-2026-35536
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.setcookie were not checked for crafted characters...
