CVE-2026-91991
1 advisory.
PyPI/tornado CVE-2026-91991: low, EPSS 0.25%
Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`
Action: Upgrade tornado to 6.5.8 or later.
pip install tornado==6.5.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.5.5 | 6.5.8 | - |
Fixed versions
| 6.5.8 |
Sources
- osv: GHSA-wwv5-g3v4-889x
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-wwv5-g3v4-889x
- https://github.com/tornadoweb/tornado/pull/3704
- https://github.com/tornadoweb/tornado/pull/3706
- https://github.com/tornadoweb/tornado/commit/6ef836e43e1278530041376adb32504daa977b91
- https://github.com/tornadoweb/tornado/commit/da284767eae8e1f0484f123b8c3225f6465b09c7
- https://github.com/tornadoweb/tornado
- https://github.com/tornadoweb/tornado/releases/tag/v6.5.8
CVE-2026-91991 · published · modified · JSON