PT-2026-29974 · Tornado+4 · Tornado+4

Dhiral2908 · CVE-2026-35536 · Published 2026-03-11 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.5.5

Description Prior to version 6.5.5, Tornado is susceptible to cookie attribute injection due to insufficient validation of the domain, path, and samesite arguments when setting cookies using .RequestHandler.set cookie. This could allow for crafted characters to be injected into these attributes.

Recommendations Update to Tornado version 6.5.5 or later.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-159

CWE-74

Related Identifiers

ALSA-2026:13641

ALSA-2026:13670

ALSA-2026:19034

ALSA-2026:19189

BDU:2026-07217

CLEANSTART-2026-AZ09261

CLEANSTART-2026-CQ05396

CLEANSTART-2026-EM82280

CLEANSTART-2026-HP19968

CLEANSTART-2026-IR98353

CLEANSTART-2026-MR94452

CLEANSTART-2026-NL78203

CLEANSTART-2026-SO50412

CLEANSTART-2026-WQ85001

CLEANSTART-2026-WU03167

CVE-2026-35536

ECHO-B644-E810-F4A8

GHSA-78CV-MQJ4-43F7

GHSA-FQWM-6JPJ-5WXC

OESA-2026-1903

PYSEC-2026-2287

RHSA-2026:13641

RHSA-2026:13670

RHSA-2026:19034

RHSA-2026:19189

RHSA-2026:20572

RHSA-2026:20573

RHSA-2026:20577

RHSA-2026:20810

RHSA-2026:24342

USN-8198-1

USN-8198-2

Affected Products

Linuxmint

Red Os

Rocky Linux

Tornado

Ubuntu

References · 259

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35536.json · Exploit
• https://github.com/tornadoweb/tornado/security/advisories/GHSA-78cv-mqj4-43f7 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8198-1 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-AZ09261 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-NL78203 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34073 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-26007 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-45186 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-62727 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-EM82280 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-49766 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25645 · Security Note
• https://errata.almalinux.org/9/ALSA-2026-19189.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48710 · Security Note
• https://osv.dev/vulnerability/ALSA-2026:19034 · Vendor Advisory