GHSA-fqwm-6jpj-5wxc

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

Database specific

{
    "nvd_published_at": "2026-04-03T04:16:53Z",
    "severity": "HIGH",
    "github_reviewed_at": "2026-04-04T06:45:00Z",
    "cwe_ids": [
        "CWE-159"
    ],
    "github_reviewed": true
}

References

Affected packages

PyPI / tornado

Package

Name: tornado; View open source insights on deps.dev
Purl: pkg:pypi/tornado

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.5.5

Affected versions

0.*

0.2

1.*

1.0

1.1

1.1.1

1.2

1.2.1

2.*

2.0

2.1

2.1.1

2.2

2.2.1

2.3

2.4

2.4.1

3.*

3.0

3.0.1

3.0.2

3.1

3.1.1

3.2

3.2.1

3.2.2

4.*

4.0

4.0.1

4.0.2

4.1b2

4.1

4.2b1

4.2

4.2.1

4.3b1

4.3b2

4.3

4.4b1

4.4

4.4.1

4.4.2

4.4.3

4.5b1

4.5b2

4.5

4.5.1

4.5.2

4.5.3

5.*

5.0a1

5.0b1

5.0

5.0.1

5.0.2

5.1b1

5.1

5.1.1

6.*

6.0a1

6.0b1

6.0

6.0.1

6.0.2

6.0.3

6.0.4

6.1b1

6.1b2

6.1

6.2b1

6.2b2

6.2

6.3b1

6.3

6.3.1

6.3.2

6.3.3

6.4b1

6.4

6.4.1

6.4.2

6.5b1

6.5

6.5.1

6.5.2

6.5.3

6.5.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-fqwm-6jpj-5wxc/GHSA-fqwm-6jpj-5wxc.json"