CVE-2026-123535
📛 CVE Title
Tornado before 6.6 Cookie Attribute Injection via set_cookie max_age
Description
Tornado before 6.6 does not validate the max_age argument of RequestHandler.set_cookie (also called by set_signed_cookie, set_secure_cookie, and clear_cookie), allowing injection of additional Set-Cookie attributes. When an application passes attacker-influenced input as max_age, an attacker can embed attributes such as Domain, Path, or Secure to widen the cookie's scope to parent paths or other subdomains.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- VulnCheck
- CVSS severity
- LOW
- CVSS score
- 2.3 / 10
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N- Effective score
- 2.3 / 10 LOW source: CNA overview
- CWE(s)
-
CWE-74 - Reserved
- 2026-11-06
- Published
- 2026-11-08 01:37 UTC
- Last updated
- 2026-11-08 01:37 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123535.json
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-119420
EUVD enrichment is queued; refresh the page in a few seconds.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| tornadoweb | tornado |
0 (affected),
6.6 (unaffected)
|
— |
Vendor references (2)
References embedded in the original CVE record by the assigning CNA.
- GitHub Security Advisory (GHSA-c6v4-qj2h-f748) vendor-advisory
- VulnCheck Advisory: Tornado before 6.6 Cookie Attribute Injection via set_cookie max_age third-party-advisory
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
Remediations (10)
-
web:docs.netscaler.com
NetScaler detects CVEs and provides remediation suggestions the same. This topic lists the remediations suggested for the following CVEs :
2026-11-08 11:27 UTC -
web:endpointweekly.com
All 633 CVEs from September 2026 Patch Tuesday — searchable, filterable, with plain-English IT admin notes on every vulnerability. Includes CVE - 2026 -81963, the exploited Windows Update Stack EoP, and the five CVEs KB5124008 does not fix .
2026-11-08 11:27 UTC -
web:hub.ivanti.com
At the time of discovery of exploitation, Ivanti had a fix developed for CVE - 2026 -104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered. Because of this, our focus was initially centered on the disclosure of CVE - 2026 -104935 and providing protection for our ...
2026-11-08 11:27 UTC -
web:learn.microsoft.com
In this library you will find the following security documents that have been released by the Microsoft Security Response Center (MSRC). The MSRC investigates all reports of security vulnerabilities affecting Microsoft products and services, and releases these documents as part of the ongoing effort ...
2026-11-08 11:27 UTC -
web:patchtuesday.istwpro.com
Countdown to the next Microsoft Patch Tuesday, every CVE in the current release, and three years of history from the MSRC Security Update Guide.
2026-11-08 11:27 UTC -
web:securityarsenal.com
CISA has confirmed active exploitation of a Windows command injection flaw and an Ivanti Connect Secure authentication bypass. Federal agencies face a BOD 26-04 deadline — here's how to detect and remediate both.
2026-11-08 11:27 UTC -
web:senserva.com
Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.
2026-11-08 11:27 UTC -
web:support.esri.com
The issues resolved by these patches are listed in the Issues addressed with this patch section below. As part of the patch installation, the ArcGIS Server service is stopped and restarted. The restart may take several minutes depending on the number of services published on the ArcGIS Server site. This patch can be uninstalled as outlined in the Uninstalling this patch on Windows and ...
2026-11-08 11:27 UTC -
web:support.sap.com
On 13 th of October 2026 , SAP security patch day saw the release of 16 new security notes and 4 GitHub security advisories. There are 2 updates to previously released security notes.
2026-11-08 11:27 UTC -
web:support.servicenow.com
What you need to know: On September 24, 2026 , ServiceNow issued CVE - 2026 -86857, CVE - 2026 -86858, CVE - 2026 -13016, CVE - 2026 -86859, and CVE - 2026 -86860. Each of these security issues was identified through internal security testing, customer security assessments, or reports submitted through ServiceNow's responsible disclosure and bug bounty programs and was remediated independently. For security ...
2026-11-08 11:27 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-123535.json.
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/tornado",
"product": "tornado",
"vendor": "tornadoweb",
"versions": [
{
"lessThan": "6.6",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.6",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zhangyan8216"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Tornado before 6.6 does not validate the max_age argument of RequestHandler.set_cookie (also called by set_signed_cookie, set_secure_cookie, and clear_cookie), allowing injection of additional Set-Cookie attributes. When an application passes attacker-influenced input as max_age, an attacker can embed attributes such as Domain, Path, or Secure to widen the cookie's scope to parent paths or other subdomains."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:37:43.142Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-c6v4-qj2h-f748)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-c6v4-qj2h-f748"
},
{
"name": "VulnCheck Advisory: Tornado before 6.6 Cookie Attribute Injection via set_cookie max_age",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/tornado-before-6.6-cookie-attribute-injection-via-set-cookie-max-age"
}
],
"title": "Tornado before 6.6 Cookie Attribute Injection via set_cookie max_age",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123535",
"datePublished": "2026-11-08T01:37:43.142Z",
"dateReserved": "2026-11-06T00:48:46.279Z",
"dateUpdated": "2026-11-08T01:37:43.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}