CVE-2026-35536

Опубликовано: 03 апр. 2026

Источник: nvd

CVSS3: 7.2

CVSS3: 5.3

EPSS Низкий

Описание

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

Ссылки

https://github.com/tornadoweb/tornado/releases/tag/v6.5.5
Product
https://github.com/tornadoweb/tornado/security/advisories/GHSA-78cv-mqj4-43f7
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:*

Версия до 6.5.5 (исключая)

EPSS

Процентиль: 15%

0.00237

Низкий

7.2 High

CVSS3

5.3 Medium

CVSS3

Дефекты

CWE-159

Связанные уязвимости

CVE-2026-35536

CVSS3: 7.2

ubuntu

5 месяцев назад

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

CVE-2026-35536

CVSS3: 5.4

redhat

5 месяцев назад

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

CVE-2026-35536

CVSS3: 7.2

debian

5 месяцев назад

In Tornado before 6.5.5, cookie attribute injection could occur becaus ...

ROS-20260512-80-0010

CVSS3: 5.3

redos

4 месяца назад

Уязвимость python-tornado

GHSA-fqwm-6jpj-5wxc

CVSS3: 7.2

github

5 месяцев назад

Tornado has cookie attribute injection via .RequestHandler.set_cookie

EPSS

Процентиль: 15%

0.00237

Низкий

7.2 High

CVSS3

5.3 Medium

CVSS3

Дефекты

CWE-159