In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

unity_linux UTSA-2026-021488: Unity Linux: python-tornado (UTSA-2026-021488)

The version of python-tornado installed on the remote host is prior to 4.2.1-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3286 advisory.

    In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite     arguments to .RequestHandler.set_cookie were not checked for crafted characters. (CVE-2026-35536)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python3-tornado installed on the remote host is prior to 5.0.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3287 advisory.

    In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite     arguments to .RequestHandler.set_cookie were not checked for crafted characters. (CVE-2026-35536)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-556:01 advisory.

    * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)
      * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments     (CVE-2026-35536)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:13641 advisory.

    * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)
      * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments     (CVE-2026-35536)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:13670 advisory.

    * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)
      * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments     (CVE-2026-35536)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:13641 advisory.

    * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

    * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments     (CVE-2026-35536)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-13641 advisory.

    [6.5.5-1.1]
    - Update to 6.5.5       Resolves: RHEL-160934

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:13670 advisory.

    * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

    * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments     (CVE-2026-35536)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-13670 advisory.

    [6.5.5-1.1]
    - Update to 6.5.5       Resolves: RHEL-160941

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:13641 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

    * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments     (CVE-2026-35536)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:13670 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

    * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments     (CVE-2026-35536)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1588 advisory.

    In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite     arguments to .RequestHandler.set_cookie were not checked for crafted characters. (CVE-2026-35536)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1587 advisory.

    In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite     arguments to .RequestHandler.set_cookie were not checked for crafted characters. (CVE-2026-35536)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the python3 package has been released.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8198-1 advisory.

    It was discovered that Tornado incorrectly handled parsing of large multipart request bodies. An attacker     could possibly use this issue to cause a denial of service. (CVE-2026-31958)

    It was discovered that Tornado did not properly validate characters in cookie values. An attacker could     possibly use this issue to inject arbitrary cookie attributes. (CVE-2026-35536)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the Tornado Python library installed on the remote host is prior to 6.5.5. It is, therefore, affected by a cookie attribute injection vulnerability:

  - Cookie attribute injection could occur because the domain, path, and samesite arguments to     RequestHandler.set_cookie were not checked for crafted characters. In particular, semicolons     would be allowed, which could be used to inject attacker-controlled values for other cookie     attributes. (CVE-2026-35536)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite     arguments to .RequestHandler.set_cookie were not checked for crafted characters. (CVE-2026-35536)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
314587	Amazon Linux 2 : python-tornado, --advisory ALAS2-2026-3286 (ALAS-2026-3286)	Nessus	Amazon Linux Local Security Checks	medium
314583	Amazon Linux 2 : python3-tornado, --advisory ALAS2-2026-3287 (ALAS-2026-3287)	Nessus	Amazon Linux Local Security Checks	medium
312848	MiracleLinux 9 : python-tornado-6.5.5-1.el9_7.1 (AXSA:2026-556:01)	Nessus	Miracle Linux Local Security Checks	high
312685	AlmaLinux 10 : python-tornado (ALSA-2026:13641)	Nessus	Alma Linux Local Security Checks	high
312681	AlmaLinux 9 : python-tornado (ALSA-2026:13670)	Nessus	Alma Linux Local Security Checks	high
312377	RockyLinux 10 : python-tornado (RLSA-2026:13641)	Nessus	Rocky Linux Local Security Checks	high
312332	Oracle Linux 10 : python-tornado (ELSA-2026-13641)	Nessus	Oracle Linux Local Security Checks	high
312323	RockyLinux 9 : python-tornado (RLSA-2026:13670)	Nessus	Rocky Linux Local Security Checks	high
312318	Oracle Linux 9 : python-tornado (ELSA-2026-13670)	Nessus	Oracle Linux Local Security Checks	high
312173	RHEL 10 : python-tornado (RHSA-2026:13641)	Nessus	Red Hat Local Security Checks	high
312171	RHEL 9 : python-tornado (RHSA-2026:13670)	Nessus	Red Hat Local Security Checks	high
311341	Amazon Linux 2023 : python3.13-tornado (ALAS2023-2026-1588)	Nessus	Amazon Linux Local Security Checks	medium
311333	Amazon Linux 2023 : python3-tornado (ALAS2023-2026-1587)	Nessus	Amazon Linux Local Security Checks	medium
310247	Photon OS 5.0: Python3 PHSA-2026-5.0-0830	Nessus	PhotonOS Local Security Checks	high
310200	Photon OS 4.0: Python3 PHSA-2026-4.0-1003	Nessus	PhotonOS Local Security Checks	high
309910	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : Tornado vulnerabilities (USN-8198-1)	Nessus	Ubuntu Local Security Checks	high
307354	Python Library Tornado < 6.5.5 Cookie Attribute Injection	Nessus	Misc.	medium
304899	Linux Distros Unpatched Vulnerability : CVE-2026-35536	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-35536

medium

Tenable Plugins

Coming Soon

medium

medium

high

high

high

high

high

high

high

high

high

medium

medium

high

high

high

medium

medium