Tornado · Tornado · CVE-2026-91991
**Name of the Vulnerable Software and Affected Versions**
Tornado versions prior to 6.5.8
**Description**
An incomplete fix for cookie attribute injection allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to the `set cookie()` function. The validation loop only rejects specific characters for lowercase keys such as `name`, `domain`, `path`, and `samesite`. However, the deprecated `**kwargs` path writes values directly into the `Morsel` without validation. Because `Morsel. setitem ` is case-insensitive, using capitalized parameters like `Domain`, `Path`, or `SameSite` bypasses the validation loop, enabling the injection of semicolon-delimited data to modify cookie security attributes, such as forcing or dropping `Secure`, `HttpOnly`, or `SameSite` flags.
**Recommendations**
Update Tornado to version 6.5.8 or later.
As a temporary workaround, avoid using capitalized or legacy keyword arguments in the `set cookie()` function.