GHSA-78cv-mqj4-43f7

Suggest an improvement
Source
https://github.com/advisories/GHSA-78cv-mqj4-43f7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-78cv-mqj4-43f7/GHSA-78cv-mqj4-43f7.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-78cv-mqj4-43f7
Downstream
Related
Published
2026-03-11T22:17:00Z
Modified
2026-03-14T07:29:05.928798Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Tornado has incomplete validation of cookie attributes
Details

Values passed to the domain, path, and samesite arguments of RequestHandler.set_cookie were not completely validated in versions of Tornado prior to 6.5.5. In particular, semicolons would be allowed, which could be used to inject attacker-controlled values for other cookie attributes.

Database specific 
{
    "cwe_ids": [
        "CWE-74"
    ],
    "github_reviewed_at": "2026-03-11T22:17:00Z",
    "github_reviewed": true,
    "nvd_published_at": null,
    "severity": "MODERATE"
}
References

Affected packages

PyPI / tornado

Package

Name
tornado
View open source insights on deps.dev
Purl
pkg:pypi/tornado

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.5.5

Affected versions

0.*
0.2
1.*
1.0
1.1
1.1.1
1.2
1.2.1
2.*
2.0
2.1
2.1.1
2.2
2.2.1
2.3
2.4
2.4.1
3.*
3.0
3.0.1
3.0.2
3.1
3.1.1
3.2
3.2.1
3.2.2
4.*
4.0
4.0.1
4.0.2
4.1b2
4.1
4.2b1
4.2
4.2.1
4.3b1
4.3b2
4.3
4.4b1
4.4
4.4.1
4.4.2
4.4.3
4.5b1
4.5b2
4.5
4.5.1
4.5.2
4.5.3
5.*
5.0a1
5.0b1
5.0
5.0.1
5.0.2
5.1b1
5.1
5.1.1
6.*
6.0a1
6.0b1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.1b1
6.1b2
6.1
6.2b1
6.2b2
6.2
6.3b1
6.3
6.3.1
6.3.2
6.3.3
6.4b1
6.4
6.4.1
6.4.2
6.5b1
6.5
6.5.1
6.5.2
6.5.3
6.5.4

Database specific

last_known_affected_version_range 
"<= 6.5.4"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-78cv-mqj4-43f7/GHSA-78cv-mqj4-43f7.json"