CVE-2026-91991: tornadoweb tornado HTTP Request/Response Splitting
Vulnerability summary
CVE-2026-91991 is a medium (CVSS 6.3) HTTP Request/Response Splitting vulnerability in tornadoweb tornado. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 14.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 4 · Related 4Timeline
- 15-09-2026PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.
CVSS metrics
8 scores · 5 sources · 2 versions- OSV · PypiEcosystem advisory · calculated2.3LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:NDiffers
- OSV · UbuntuEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
- OSV · DebianEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST6.3MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.25%
Chance of exploitation in the next 30 days
Percentile
15%
Versus all other CVEs
30-day change
+0.03 pp
From 0.22% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- python-tornadoAll versions (No fix recorded)
PyPI1 product
- tornado≥ 6.5.5, < 6.5.8
Tornadoweb1 product
- tornado≥ 6.5.5, < 6.5.8
Ubuntu1 product
- python-tornadoAll versions (No fix recorded)
4 vendors · 4 products
