UBUNTU-CVE-2026-35536

Details

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

Affected Packages

python-tornado

Ubuntu 24.04 LTS

Fixed in:

6.4.0-1ubuntu0.5

python-tornado

Ubuntu 25.10

Fixed in:

6.4.2-3ubuntu0.3

python-tornado

Ubuntu 26.04

Affected versions:

6.4.2-36.5.2-36.5.4-0.1

python-tornado

Ubuntu Pro 16.04 LTS

Fixed in:

4.2.1-1ubuntu3.1+esm3

python-tornado

Ubuntu Pro 18.04 LTS

Fixed in:

4.5.3-1ubuntu0.2+esm3

python-tornado

Ubuntu Pro 20.04 LTS

Fixed in:

6.0.3+really5.1.1-3ubuntu0.1~esm5

python-tornado

Ubuntu Pro 22.04 LTS

Fixed in:

6.1.0-3ubuntu0.1~esm5

References

REPORT

https://github.com/tornadoweb/tornado/releases/tag/v6.5.5

REPORT

https://github.com/tornadoweb/tornado/security/advisories/GHSA-78cv-mqj4-43f7

REPORT

https://ubuntu.com/security/CVE-2026-35536

ADVISORY

https://ubuntu.com/security/notices/USN-8198-1

REPORT

https://www.cve.org/CVERecord?id=CVE-2026-35536