Summary
Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive **kwargs path in set_cookie
The CVE-2026-35536 fix added a validation loop that rejects [\x00-\x20\x3b\x7f], but only for the
hardcoded lowercase keys name/domain/path/samesite. The still-live deprecated **kwargs path
writes attacker-supplied attribute values straight into the Morsel with no validation, and becauseMorsel.__setitem__ is case-insensitive, a capitalized kwarg (Domain=, Path=, SameSite=, Max-Age=)
routes to the same reserved attribute while bypassing the loop, re-opening ;-delimited attribute injection.
self.set_cookie("sid", "abc", Domain="evil.com; Secure; SameSite=None")
# -> Set-Cookie: sid=abc; Domain=evil.com; Secure; SameSite=None; Path=/
# Sanity (the canonical lowercase named arg IS blocked):
self.set_cookie("sid", "abc", domain="evil.com; Secure") # -> http.cookies.CookieError
The patch's regression test (SetCookieForbiddenCharHandler) only exercises the four named params, never the**kwargs path, so the gap is not regression-covered.
Affected code
tornado/web.py→RequestHandler.set_cookie: the validation loop covers only the lowercase named args;
the trailingif kwargs:loop doesmorsel[k] = vwith no character validation.
Steps to reproduce
GET /upper (uses Domain= kwarg) emits Set-Cookie: c_upper=v; Domain=evil.com; Secure; SameSite=None; Path=/; GET /lower (uses lowercasedomain=) returns a CookieError.
Suggested remediation
Apply the same [\x00-\x20\x3b\x7f] validation to every entry in the **kwargs loop (after normalizing the
key case), or remove the deprecated kwargs path; add a regression test for capitalized kwargs.
Credit
Reported as part of an incomplete-patch measurement study (responsible disclosure).
Impact
Injection of independent cookie attributes (force/drop Secure/HttpOnly/SameSite, rebind Domain/Path)
the same impact CVE-2026-35536 closed, via the sibling path the patch missed. Conditional on the app using
a capitalized/legacy keyword.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is GHSA-WWV5-G3V4-889X? GHSA-WWV5-G3V4-889X is a low-severity security vulnerability in tornado (pip), affecting versions >= 6.5.5, < 6.5.8. It is fixed in 6.5.8.
- Which versions of tornado are affected by GHSA-WWV5-G3V4-889X? tornado (pip) versions >= 6.5.5, < 6.5.8 is affected.
- Is there a fix for GHSA-WWV5-G3V4-889X? Yes. GHSA-WWV5-G3V4-889X is fixed in 6.5.8. Upgrade to this version or later.
- Is GHSA-WWV5-G3V4-889X exploitable, and should I be worried? Whether GHSA-WWV5-G3V4-889X is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-WWV5-G3V4-889X is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-WWV5-G3V4-889X? Upgrade
tornadoto 6.5.8 or later.