Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Affecting tornado package, versions [,6.6b1)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-TORNADO-22371907
- published8 Nov 2026
- disclosed8 Nov 2026
- creditzhangyan8216
Introduced: 8 Nov 2026
NewCVE-2026-123535 (opens in a new tab)How to fix?
Upgrade tornado to version 6.6b1 or higher.
Overview
tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.
Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the max_age argument of RequestHandler.set_cookie (also invoked by set_signed_cookie, set_secure_cookie, and clear_cookie). When an application passes attacker-influenced input as max_age without first converting it to an integer, an attacker can embed a semicolon-delimited string that injects additional Set-Cookie attributes - such as Domain, Path, or Secure - directly into the response header, widening the cookie's scope to parent paths or other subdomains.
Note: This is only exploitable when the application passes a value derived from untrusted input as the max_age argument without converting it to an integer first.
Workaround
Convert max_age to an integer (for example with int()) before passing it to set_cookie.