Skip to main content

Improper Handling of Invalid Use of Special Elements

CVE-2026-35536

Medium
5.3/10

Summary

In Tornado prior to 6.5.5, cookie attribute injection could occur because the `domain`, `path`, and `samesite` arguments to `.RequestHandler.set_cookie` were not checked for crafted characters.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • NONE

CWE-159 - Improper Handling of Invalid Use of Special Elements

The product does not properly filter, remove, quote, or otherwise manage the invalid use of special elements in user-controlled input, which could cause adverse effect on its behavior and integrity.

References

Advisory Timeline

  • Published