Description
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tornadoweb | Tornado | < 6.5.5 | 6.5.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-tornado | 6.5.5-1 | — |
| Debian 13 | python-tornado | No fix yet | — |
| Debian 12 | python-tornado | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | python-tornado | 6.5.4-0.1ubuntu0.1 | — |
| Ubuntu 25.10 | python-tornado | 6.4.2-3ubuntu0.3 | — |
| Ubuntu 24.04 LTS | python-tornado | 6.4.0-1ubuntu0.5 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | python-tornado | 6.1.0-3ubuntu0.1~esm5 | — |
| Ubuntu Pro 18.04 LTS | python-tornado | 4.5.3-1ubuntu0.2+esm3 | — |
| Ubuntu Pro 16.04 LTS | python-tornado | 4.2.1-1ubuntu3.1+esm3 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | python-tornado +1 | 6.5.5-1.el10_1.1 | RHSA-2026:19034, RHSA-2026:13641 |
| RHEL 9 | python-tornado +1 | 6.5.5-1.el9_7.1 | RHSA-2026:19189, RHSA-2026:13670 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | python-tornado +1 | 6.4.2-1.el10_0.2 | RHSA-2026:20577 |
| RHEL 9.6 EUS | python-tornado +1 | 6.4.2-2.el9_6.3 | RHSA-2026:20572 |
| RHEL 9.4 EUS | python-tornado +1 | 6.4.2-1.el9_4.2 | RHSA-2026:20810 |
| RHEL 9.2 E4S | python-tornado +1 | 6.4.2-1.el9_2.2 | RHSA-2026:20573 |
| RHEL 7 ELS | python-tornado +1 | 4.2.1-5.el7_9.3 | RHSA-2026:24342 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | python3-tornado | 6.5.5-1.el10_1.1 | ALSA-2026:19034, ALSA-2026:13641 |
| AlmaLinux 9 | python3-tornado | 6.5.5-1.el9_7.1 | ALSA-2026:19189, ALSA-2026:13670 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | python-tornado | 6.5.5-1.el10_1.1 | RLSA-2026:19034, RLSA-2026:13641 |
| Rocky Linux 9 | python-tornado | 6.5.5-1.el9_7.1 | RLSA-2026:19189, RLSA-2026:13670 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3-tornado +1 | 6.1.0-2.amzn2023.0.8 | ALAS2023-2026-1587 |
| Amazon Linux 2023 | python3.13-tornado +1 | 6.4.2-1.amzn2023.0.3 | ALAS2023-2026-1588 |
| Amazon Linux 2 | python-tornado +1 | 4.2.1-3.amzn2.0.5 | ALAS2-2026-3286 |
| Amazon Linux 2 | python3-tornado +1 | 5.0.2-4.amzn2.0.8 | ALAS2-2026-3287 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | python3-tornado | 6.5.5-1.el10_1.1 | ELSA-2026-19034, ELSA-2026-13641 |
| Oracle Linux 9 | python3-tornado | 6.5.5-1.el9_7.1 | ELSA-2026-19189, ELSA-2026-13670 |
| Oracle Linux 7 | python-tornado +1 | 4.2.1-5.0.3.el7 | ELSA-2026-24342 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | mitmproxy | 12.2.2-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | tornado | < 6.5.5 | 6.5.5 | GHSA-78cv-mqj4-43f7 |
Advisories 27
- WID-SEC-2026-2933 Splunk SOAR: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- ALSA-2026:13641 Moderate: python-tornado security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:19189 Moderate: python-tornado security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:13670 Moderate: python-tornado security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:19034 Moderate: python-tornado security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:24342 Red Hat Security Advisory: python-tornado security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:20810 Red Hat Security Advisory: python-tornado security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:20573 Red Hat Security Advisory: python-tornado security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:20577 Red Hat Security Advisory: python-tornado security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:20572 Red Hat Security Advisory: python-tornado security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:19189 Red Hat Security Advisory: python-tornado security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:19034 Red Hat Security Advisory: python-tornado security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:13670 Red Hat Security Advisory: python-tornado security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:13641 Red Hat Security Advisory: python-tornado security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- ELSA-2026-24342 Moderate: python-tornado security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 30, 2026
- ELSA-2026-19034 Moderate: python-tornado security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 8, 2026
- ELSA-2026-19189 Moderate: python-tornado security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 12, 2026
- RLSA-2026:19034 Moderate: python-tornado security update Rocky Linux Security Advisories · May 29, 2026
- RLSA-2026:19189 Moderate: python-tornado security update Rocky Linux Security Advisories · May 21, 2026
- ALAS2-2026-3286 Moderate: python-tornado security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 13, 2026
- ALAS2-2026-3287 Moderate: python3-tornado security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 13, 2026
- RLSA-2026:13641 Moderate: python-tornado security update Rocky Linux Security Advisories · May 6, 2026
- RLSA-2026:13670 Moderate: python-tornado security update Rocky Linux Security Advisories · May 6, 2026
- ELSA-2026-13641 Moderate: python-tornado security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · May 5, 2026
- ELSA-2026-13670 Moderate: python-tornado security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 5, 2026
- ALAS2023-2026-1587 Moderate: python-tornado security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 30, 2026
- ALAS2023-2026-1588 Moderate: python3.13-tornado security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 30, 2026