CVE-2026-35536

A flaw was found in Tornado. A remote attacker could exploit this vulnerability by injecting specially crafted characters into the domain, path, and samesite arguments when setting cookies. This could lead to cookie attribute injection, potentially allowing for information disclosure or manipulation of client-side data.

This vulnerability is rated as Moderate because successful exploitation requires an application to pass untrusted, user-supplied data into cookie configuration parameters, limiting the risk in standard deployments. In typical Red Hat environments running Tornado web services, cookie attributes such as domain, path, and SameSite policies are statically configured rather than derived from client input. If an application does expose these parameters to untrusted input, the flaw allows injection of supplementary cookie directives, potentially leading to unauthorized client-side state manipulation or session fixation without enabling host-level compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.