CVE-2026-91991 Overview
CVE-2026-91991 affects the Tornado Python web framework in versions before 6.5.8. The vulnerability represents an incomplete fix for a prior cookie attribute injection issue [CWE-113]. Attackers can inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to the set_cookie method. By embedding semicolon-delimited data in parameters such as Domain, Path, or SameSite, an attacker bypasses input validation and modifies cookie security attributes. This can weaken cookie scoping and same-site protections in applications that pass untrusted input to cookie APIs.
Critical Impact
Attackers can manipulate cookie security attributes to broaden cookie scope, downgrade SameSite protections, or influence how browsers transmit session cookies.
Affected Products
- Tornado web framework versions before 6.5.8
- Python applications using Tornado's set_cookie API with untrusted input
- Downstream frameworks and services embedding vulnerable Tornado releases
Discovery Timeline
- 2026-09-15 - CVE-2026-91991 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in the NVD database
Technical Details for CVE-2026-91991
Vulnerability Analysis
The flaw lives in Tornado's set_cookie implementation, which accepts keyword arguments controlling cookie attributes. A prior fix restricted lowercase attribute keywords against semicolon injection but did not normalize capitalized or legacy variants. An attacker who controls values passed to arguments like Domain, Path, Expires, or SameSite can inject additional cookie attributes by embedding semicolons and attribute pairs within the value.
Because cookie attributes govern browser behavior around scope, expiration, and cross-site transmission, injection can weaken session isolation. The vulnerability is classified as HTTP Response Splitting-adjacent under [CWE-113], since attacker input alters the structure of the emitted Set-Cookie header. Exploitation requires the application to forward untrusted data into capitalized or legacy kwargs, which raises attack complexity.
Root Cause
The root cause is inconsistent normalization of keyword arguments in the cookie-setting code path. Validation logic checks lowercase attribute names but skips capitalized and deprecated aliases. Values reaching the header serializer are then concatenated without escaping semicolons, allowing structural injection.
Attack Vector
Exploitation occurs over the network against any Tornado application that passes user-controlled data to set_cookie via capitalized or legacy kwargs. An attacker submits input containing a semicolon followed by an attribute such as ; Domain=attacker.example. Tornado emits the payload verbatim in the response Set-Cookie header, causing the browser to honor the injected attribute. Refer to the GitHub Security Advisory GHSA-wwv5-g3v4-889x and the VulnCheck Advisory: Tornado Cookie Injection for the disclosed technical details.
Detection Methods for CVE-2026-91991
Indicators of Compromise
- Outbound Set-Cookie response headers containing unexpected duplicate attributes such as multiple Domain= or Path= values.
- Application logs showing calls to set_cookie with capitalized kwargs like Domain, Path, Expires, or SameSite.
- Request parameters containing URL-encoded semicolons (%3B) followed by cookie attribute keywords.
Detection Strategies
- Perform static analysis on Python source to locate set_cookie invocations that receive user-controlled data through capitalized or legacy keyword arguments.
- Inspect HTTP response traffic for malformed Set-Cookie headers whose structure includes injected attributes not defined by the application.
- Compare deployed Tornado versions against the fixed baseline of 6.5.8 in software bill of materials (SBOM) and dependency manifests.
Monitoring Recommendations
- Alert on web application firewall (WAF) events flagging semicolon injection patterns targeting request parameters that map to cookie values.
- Monitor build pipelines for Tornado package versions below 6.5.8 and gate deployments on remediation.
- Capture response headers in centralized logging to enable retrospective hunts for cookie header anomalies.
How to Mitigate CVE-2026-91991
Immediate Actions Required
- Upgrade Tornado to version 6.5.8 or later across all Python applications and container images.
- Audit application code for calls to set_cookie that pass user-controlled input, particularly via capitalized keyword arguments.
- Rotate active session cookies if evidence of exploitation is present in response header logs.
Patch Information
The Tornado maintainers released version 6.5.8 to fully address the incomplete fix. The patch normalizes keyword argument casing and validates all cookie attribute inputs against semicolon injection. Details are documented in the GitHub Security Advisory GHSA-wwv5-g3v4-889x.
Workarounds
- Sanitize any user-controlled data before passing it to set_cookie, rejecting values containing semicolons or control characters.
- Refactor code to use only the documented lowercase parameter names (domain, path, expires, samesite) and avoid legacy aliases.
- Deploy WAF rules that block request payloads embedding cookie attribute keywords following semicolons in fields destined for cookie values.
# Configuration example
pip install --upgrade "tornado>=6.5.8"
pip show tornado | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
