GHSA-wwv5-g3v4-889x: Cookie Attribute Injection in Tornado via Legacy Case-Insensitive kwargs
Vulnerability ID: GHSA-WWV5-G3V4-889X
CVSS Score: 2.3
Published: 2026-09-01
An incomplete sanitization fix for CVE-2026-35536 in Tornado allowed cookie attribute injection. The framework's validation loop checked lowercase keyword arguments but neglected legacy case-insensitive parameters passed through arbitrary keyword arguments, which Python's underlying library parses case-insensitively.
TL;DR
Tornado's cookie validation bypassed legacy case-insensitive kwargs, allowing arbitrary attribute injection.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-74
- Attack Vector: Network (AV:N)
- CVSS Score: 2.3 (Low)
- Exploit Status: Proof-of-Concept (PoC)
- KEV Status: Not Listed
- Impact: Cookie Attribute Injection / Security Policy Bypass
Affected Systems
- Tornado web server applications using mixed-case cookie parameters (versions >= 6.5.5, < 6.5.8)
-
tornado: >= 6.5.5, < 6.5.8 (Fixed in:
6.5.8)
Code Analysis
Commit: 6ef836e
Check for disallowed characters in deprecated kwargs
Commit: da28476
Add regression tests for case-insensitive cookie parameter parsing validation
Mitigation Strategies
- Upgrade to Tornado version 6.5.8 or higher.
- Refactor all codebase instances of
set_cookieto use explicit lowercase parameter names. - Apply manual regex filters to any parameters dynamically passed to legacy wrapper functions.
Remediation Steps:
- Run automated codebase scans to find calls to
set_cookiecontaining capitalized parameters. - Update requirements files to pin
tornado>=6.5.8. - Rebuild and redeploy application containers.
- Verify cookie headers generated by the application do not contain unvalidated user payload blocks.
References
- GitHub Security Advisory GHSA-wwv5-g3v4-889x
- Tornado Security Advisory
- Tornado Pull Request 3704
- Tornado Pull Request 3706
Read the full report for GHSA-WWV5-G3V4-889X on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)