PYSEC-2026-2287
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/tornado/PYSEC-2026-2287.yaml
- JSON Data
- https://api.test.osv.dev/v1/vulns/PYSEC-2026-2287
- Aliases
- Published
- 2026-04-03T04:16:53Z
- Modified
- 2026-07-13T16:49:43Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.
- References
Affected packages
PyPI / tornado
Package
- Name
- tornado
- View open source insights on deps.dev
- Purl
- pkg:pypi/tornado
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed6.5.5
Affected versions
0.*
0.2
1.*
1.0
1.1
1.1.1
1.2
1.2.1
2.*
2.0
2.1
2.1.1
2.2
2.2.1
2.3
2.4
2.4.1
3.*
3.0
3.0.1
3.0.2
3.1
3.1.1
3.2
3.2.1
3.2.2
4.*
4.0
4.0.1
4.0.2
4.1b2
4.1
4.2b1
4.2
4.2.1
4.3b1
4.3b2
4.3
4.4b1
4.4
4.4.1
4.4.2
4.4.3
4.5b1
4.5b2
4.5
4.5.1
4.5.2
4.5.3
5.*
5.0a1
5.0b1
5.0
5.0.1
5.0.2
5.1b1
5.1
5.1.1
6.*
6.0a1
6.0b1
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.1b1
6.1b2
6.1
6.2b1
6.2b2
6.2
6.3b1
6.3
6.3.1
6.3.2
6.3.3
6.4b1
6.4
6.4.1
6.4.2
6.5b1
6.5
6.5.1
6.5.2
6.5.3
6.5.4