PT-2026-29974 · Tornado+4 · Tornado+4

Dhiral2908 · CVE-2026-35536 · Publicado 2026-03-11 · Atualizado 2026-07-21

Positive Technologies (AI Summary) · Pt

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Versões do Tornado anteriores a 6.5.5

Description Anteriormente à versão 6.5.5, o Tornado é suscetível à injeção de atributos de cookie devido à validação insuficiente dos argumentos domain, path e samesite ao definir cookies usando .RequestHandler.set cookie. Isso pode permitir a injeção de caracteres criados nesses atributos.

Recommendations Atualize para a versão 6.5.5 ou posterior do Tornado.

Exploit

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-159

CWE-74

Identificadores relacionados

ALSA-2026:13641

ALSA-2026:13670

ALSA-2026:19034

ALSA-2026:19189

BDU:2026-07217

CLEANSTART-2026-AZ09261

CLEANSTART-2026-CQ05396

CLEANSTART-2026-EM82280

CLEANSTART-2026-HP19968

CLEANSTART-2026-IR98353

CLEANSTART-2026-MR94452

CLEANSTART-2026-NL78203

CLEANSTART-2026-SO50412

CLEANSTART-2026-WQ85001

CLEANSTART-2026-WU03167

CVE-2026-35536

ECHO-B644-E810-F4A8

GHSA-78CV-MQJ4-43F7

GHSA-FQWM-6JPJ-5WXC

OESA-2026-1903

PYSEC-2026-2287

RHSA-2026:13641

RHSA-2026:13670

RHSA-2026:19034

RHSA-2026:19189

RHSA-2026:20572

RHSA-2026:20573

RHSA-2026:20577

RHSA-2026:20810

RHSA-2026:24342

USN-8198-1

USN-8198-2

Produtos afetados

Linuxmint

Red Os

Rocky Linux

Tornado

Ubuntu

Referências · 259

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35536.json · Exploit
• https://github.com/tornadoweb/tornado/commit/24a2d96ea115f663b223887deb0060f13974c104 · Nota
• https://github.com/tornadoweb/tornado · Nota
• https://github.com/tornadoweb/tornado/security/advisories/GHSA-78cv-mqj4-43f7 · Aviso do Fabricante
• https://github.com/tornadoweb/tornado/releases/tag/v6.5.5 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-HP19968.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-WU03167.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-EM82280.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-IR98353.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SO50412.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-NL78203.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-WQ85001.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-AZ09261.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-CQ05396.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-MR94452.json · Nota