CVE-2026-91991

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-91991
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91991.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-91991
Aliases
Downstream
Published
2026-09-15T15:18:32Z
Modified
2026-09-16T03:48:58Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs
Details

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-113"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91991.json"
}
References

Affected packages

Git / github.com/tornadoweb/tornado

Affected ranges

Type
GIT
Repo
https://github.com/tornadoweb/tornado
Events
Introduced
7d6465056ceb7a054b3f64cf1c18271753b10482
Fixed
a55abe3e3bf59994f29b2f7084c46341f0d4f6a7
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "6.5.5"
        },
        {
            "fixed": "6.5.8"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v6.*
v6.5.5
v6.5.6
v6.5.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91991.json"