Every CVE Search/ Get API key

CVE-2026-35536

Tornado has incomplete validation of cookie attributes

7.2 HighFix available

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.25%Up 0.2 points since Apr 3, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.2

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

Record
CVE-2026-35536
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-159
Updated
2026-11-02
EUVDEUVD-2026-18574 7.2

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

Record
EUVD-2026-18574
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-78cv-mqj4-43f7 5.4

Tornado has incomplete validation of cookie attributes

Values passed to the domain, path, and samesite arguments of RequestHandler.set_cookie were not completely validated in versions of Tornado prior to 6.5.5. In particular, semicolons would be allowed, which could be used to inject attacker-controlled values for other cookie attributes.

Record
GHSA-78cv-mqj4-43f7
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-74
Updated
2026-11-02
GitHub AdvisoriesGHSA-fqwm-6jpj-5wxc 7.2

Tornado has cookie attribute injection via .RequestHandler.set_cookie

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

Record
GHSA-fqwm-6jpj-5wxc
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-159
Updated
2026-11-02
NVD 7.2

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

Record
CVE-2026-35536
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-159
Updated
2026-11-02
OSVBELL-CVE-2026-35536 5.3
Record
BELL-CVE-2026-35536
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
Show 29 moreShow less
OSV 7.2

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

Record
CVE-2026-35536
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-159
Updated
2026-11-02
OSVDEBIAN-CVE-2026-35536 5.3

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

Record
DEBIAN-CVE-2026-35536
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVGHSA-78cv-mqj4-43f7 5.4

Tornado has incomplete validation of cookie attributes

Values passed to the domain, path, and samesite arguments of RequestHandler.set_cookie were not completely validated in versions of Tornado prior to 6.5.5. In particular, semicolons would be allowed, which could be used to inject attacker-controlled values for other cookie attributes.

Record
GHSA-78cv-mqj4-43f7
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-74
Updated
2026-11-02
OSVGHSA-fqwm-6jpj-5wxc 7.2

Tornado has cookie attribute injection via .RequestHandler.set_cookie

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

Record
GHSA-fqwm-6jpj-5wxc
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-159
Updated
2026-11-02
OSVOESA-2026-1903 7.2

python-tornado security update

Tornado is an open source version of the scalable, non-blocking web server and tools.

Security Fix(es):

Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom "reason" phrases (the "Not Found" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). This issue is fixed in version 6.5.3.(CVE-2025-67724)

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.(CVE-2026-35536)

Record
OESA-2026-1903
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVPYSEC-2026-2287 5.3

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

Record
PYSEC-2026-2287
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:13641 5.4

Red Hat Security Advisory: python-tornado security update

Record
RHSA-2026:13641
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:13670 5.4

Red Hat Security Advisory: python-tornado security update

Record
RHSA-2026:13670
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:19034 5.4

Red Hat Security Advisory: python-tornado security update

Record
RHSA-2026:19034
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:19189 5.4

Red Hat Security Advisory: python-tornado security update

Record
RHSA-2026:19189
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:20572 5.4

Red Hat Security Advisory: python-tornado security update

Record
RHSA-2026:20572
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:20573 5.4

Red Hat Security Advisory: python-tornado security update

Record
RHSA-2026:20573
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:20577 5.4

Red Hat Security Advisory: python-tornado security update

Record
RHSA-2026:20577
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:20810 5.4

Red Hat Security Advisory: python-tornado security update

Record
RHSA-2026:20810
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:24342 5.4

Red Hat Security Advisory: python-tornado security update

Record
RHSA-2026:24342
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVRLSA-2026:13641 5.4

Moderate: python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

  • tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

  • tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:13641
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVRLSA-2026:13670 5.4

Moderate: python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

  • tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

  • tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:13670
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVRLSA-2026:19034 5.4

Moderate: python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

  • tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

  • tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:19034
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVRLSA-2026:19189 5.4

Moderate: python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

  • tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

  • tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:19189
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2026-35536 7.2

CVE-2026-35536 in tornado - Patched by Root

Root has patched CVE-2026-35536 in the tornado package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2026-35536
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVROOT-APP-PYPI-GHSA-78cv-mqj4-43f7 5.4

GHSA-78cv-mqj4-43f7 in tornado - Patched by Root

Root has patched GHSA-78cv-mqj4-43f7 in the tornado package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-GHSA-78cv-mqj4-43f7
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-35536 7.2

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

Record
UBUNTU-CVE-2026-35536
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVALSA-2026:13641 No score

Moderate: python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

  • tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)
  • tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:13641
Updated
2026-11-02
OSVALSA-2026:13670 No score

Moderate: python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

  • tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)
  • tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:13670
Updated
2026-11-02
OSVALSA-2026:19034 No score

Moderate: python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

  • tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)
  • tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:19034
Updated
2026-11-02
OSVALSA-2026:19189 No score

Moderate: python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

  • tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)
  • tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:19189
Updated
2026-11-02
OSVCLSA-2026-1776386115 No score

TuxCare security update for tornado (6 CVEs)

TuxCare rebuilt tornado to address 6 CVEs. Fixed in 6.1.0.post2+tuxcare.

Record
CLSA-2026-1776386115
Updated
2026-11-02
OSVCLSA-2026-1790675116 No score

TuxCare security update for tornado (15 CVEs)

TuxCare rebuilt tornado to address 15 CVEs. Fixed in 5.1.1.post4+tuxcare.

Record
CLSA-2026-1790675116
Updated
2026-11-02
OSVMGASA-2026-0216 No score

Updated python-tornado packages fix security vulnerabilities

Tornado has a DoS due to too many multipart parts. (CVE-2026-31958) In Tornado, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters. (CVE-2026-35536)

Record
MGASA-2026-0216
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tornado
PyPI
 through 6.5.4
6.5.5
tornado
PyPI
 before 6.5.5
6.5.5
python3-tornado
AlmaLinux:10
From an advisory covering 2 CVEs
 before 6.5.5-1.el10_1.1
6.5.5-1.el10_1.1
python3-tornado
AlmaLinux:9
From an advisory covering 2 CVEs
 before 6.5.5-1.el9_7.1
6.5.5-1.el9_7.1
python3-tornado
AlmaLinux:10
From an advisory covering 2 CVEs
 before 6.5.5-1.el10_2
6.5.5-1.el10_2
python3-tornado
AlmaLinux:9
From an advisory covering 2 CVEs
 before 6.5.5-1.el9_8
6.5.5-1.el9_8
py3-tornado
Alpaquita:25
 6.5.1-r0 up to 6.5.5-r0
6.5.5-r0
py3-tornado
Alpaquita:stream
 6.3.3-r0 up to 6.5.5-r0
6.5.5-r0
tornado
TuxCare:PyPI
From an advisory covering 2 CVEs
 6.1 up to 6.1.0.post2+tuxcare, plus listed versions
6.1.0.post1+tuxcare
6.1.0.post2+tuxcare
tornado
TuxCare:PyPI
From an advisory covering 9 CVEs
 5.1.1 up to 5.1.1.post4+tuxcare, plus listed versions
5.1.1.post1+tuxcare5.1.1.post2+tuxcare5.1.1.post3+tuxcare
5.1.1.post4+tuxcare
Show 55 moreShow less
Affected packages
PackageAffectedFixed
python-tornado
Debian:12
 All versions, plus listed versions
6.2.0-36.2.0-3+deb12u16.2.0-3+deb12u26.2.0-3+deb12u36.2.0-3+deb12u4
Show 19 moreShow less
6.3.2-16.4.0-16.4.0-26.4.1-16.4.1-26.4.1-36.4.2-16.4.2-26.4.2-36.5.2-16.5.2-26.5.2-36.5.4-0.16.5.4-16.5.5-16.5.5-26.5.5-36.5.5-46.5.5-5
 None known
python-tornado
Debian:13
 All versions, plus listed versions
6.4.2-36.4.2-3+deb13u16.4.2-3+deb13u26.5.2-16.5.2-2
Show 8 moreShow less
6.5.2-36.5.4-0.16.5.4-16.5.5-16.5.5-26.5.5-36.5.5-46.5.5-5
 None known
python-tornado
Debian:14
 before 6.5.5-1, plus listed versions
6.4.2-36.5.2-16.5.2-26.5.2-36.5.4-0.16.5.4-1
6.5.5-1
tornado
PyPI
 before 6.5.5, plus listed versions
0.21.01.11.1.11.2
Show 45 moreShow less
1.2.12.02.12.1.12.22.2.12.32.42.4.13.03.0.13.0.23.13.1.13.23.2.13.2.24.04.0.14.0.24.14.1b24.24.2.14.2b14.34.3b14.3b24.44.4.14.4.24.4.34.4b14.54.5.14.5.24.5.34.5b14.5b25.05.0.15.0.25.0a15.0b15.1
6.5.5
python-tornado
Mageia:9
From an advisory covering 2 CVEs
 before 6.3.2-1.4.mga9
6.3.2-1.4.mga9
python-tornado
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 6.5-4.oe2403sp3
6.5-4.oe2403sp3
python-tornado
openEuler:20.03-LTS-SP4
From an advisory covering 2 CVEs
 before 5.0.2-12.oe2003sp4
5.0.2-12.oe2003sp4
python-tornado
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 6.1-7.oe2203sp4
6.1-7.oe2203sp4
python-tornado
openEuler:24.03-LTS
From an advisory covering 2 CVEs
 before 6.5-4.oe2403sp2
6.5-4.oe2403sp2
python-tornado
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 6.5-4.oe2403sp1
6.5-4.oe2403sp1
python-tornado
openEuler:24.03-LTS-SP2
From an advisory covering 2 CVEs
 before 6.5-4.oe2403sp2
6.5-4.oe2403sp2
python-tornado
Red Hat:enterprise_linux:10.1
From an advisory covering 2 CVEs
 before 0:6.5.5-1.el10_1.1
0:6.5.5-1.el10_1.1
python-tornado-debugsource
Red Hat:enterprise_linux:10.1
From an advisory covering 2 CVEs
 before 0:6.5.5-1.el10_1.1
0:6.5.5-1.el10_1.1
python3-tornado
Red Hat:enterprise_linux:10.1
From an advisory covering 2 CVEs
 before 0:6.5.5-1.el10_1.1
0:6.5.5-1.el10_1.1
python3-tornado-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 2 CVEs
 before 0:6.5.5-1.el10_1.1
0:6.5.5-1.el10_1.1
python-tornado
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:6.5.5-1.el9_7.1
0:6.5.5-1.el9_7.1
python-tornado-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:6.5.5-1.el9_7.1
0:6.5.5-1.el9_7.1
python3-tornado
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:6.5.5-1.el9_7.1
0:6.5.5-1.el9_7.1
python3-tornado-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:6.5.5-1.el9_7.1
0:6.5.5-1.el9_7.1
python-tornado
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:6.5.5-1.el10_2
0:6.5.5-1.el10_2
python-tornado-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:6.5.5-1.el10_2
0:6.5.5-1.el10_2
python3-tornado
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:6.5.5-1.el10_2
0:6.5.5-1.el10_2
python3-tornado-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:6.5.5-1.el10_2
0:6.5.5-1.el10_2
python-tornado
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:6.5.5-1.el9_8
0:6.5.5-1.el9_8
python-tornado-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:6.5.5-1.el9_8
0:6.5.5-1.el9_8
python3-tornado
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:6.5.5-1.el9_8
0:6.5.5-1.el9_8
python3-tornado-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:6.5.5-1.el9_8
0:6.5.5-1.el9_8
python-tornado
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:6.4.2-2.el9_6.3
0:6.4.2-2.el9_6.3
python-tornado-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:6.4.2-2.el9_6.3
0:6.4.2-2.el9_6.3
python3-tornado
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:6.4.2-2.el9_6.3
0:6.4.2-2.el9_6.3
python3-tornado-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 0:6.4.2-2.el9_6.3
0:6.4.2-2.el9_6.3
python-tornado
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 2 CVEs
 before 0:6.4.2-1.el9_2.2
0:6.4.2-1.el9_2.2
python-tornado-debugsource
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 2 CVEs
 before 0:6.4.2-1.el9_2.2
0:6.4.2-1.el9_2.2
python3-tornado
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 2 CVEs
 before 0:6.4.2-1.el9_2.2
0:6.4.2-1.el9_2.2
python3-tornado-debuginfo
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 2 CVEs
 before 0:6.4.2-1.el9_2.2
0:6.4.2-1.el9_2.2
python-tornado
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 0:6.4.2-1.el10_0.2
0:6.4.2-1.el10_0.2
python-tornado-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 0:6.4.2-1.el10_0.2
0:6.4.2-1.el10_0.2
python3-tornado
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 0:6.4.2-1.el10_0.2
0:6.4.2-1.el10_0.2
python3-tornado-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 0:6.4.2-1.el10_0.2
0:6.4.2-1.el10_0.2
python-tornado
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 2 CVEs
 before 0:6.4.2-1.el9_4.2
0:6.4.2-1.el9_4.2
python-tornado-debugsource
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 2 CVEs
 before 0:6.4.2-1.el9_4.2
0:6.4.2-1.el9_4.2
python3-tornado
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 2 CVEs
 before 0:6.4.2-1.el9_4.2
0:6.4.2-1.el9_4.2
python3-tornado-debuginfo
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 2 CVEs
 before 0:6.4.2-1.el9_4.2
0:6.4.2-1.el9_4.2
python-tornado
Red Hat:rhel_els:7
From an advisory covering 2 CVEs
 before 0:4.2.1-5.el7_9.3
0:4.2.1-5.el7_9.3
python-tornado-debuginfo
Red Hat:rhel_els:7
From an advisory covering 2 CVEs
 before 0:4.2.1-5.el7_9.3
0:4.2.1-5.el7_9.3
python-tornado-doc
Red Hat:rhel_els:7
From an advisory covering 2 CVEs
 before 0:4.2.1-5.el7_9.3
0:4.2.1-5.el7_9.3
python-tornado
Rocky Linux:10
From an advisory covering 2 CVEs
 before 0:6.5.5-1.el10_1.1
0:6.5.5-1.el10_1.1
python-tornado
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:6.5.5-1.el9_7.1
0:6.5.5-1.el9_7.1
tornado
Root:PyPI
 before 6.2+aikido.10
6.2+aikido.106.5.3+aikido.46.4.1+aikido.36.2+aikido.36.2+aikido.46.2+aikido.56.2+aikido.66.2+aikido.76.2+aikido.86.5.3+aikido.76.4.1+aikido.46.2+aikido.96.5.3+aikido.56.4.1+aikido.56.2+aikido.116.2+aikido.126.5.3+aikido.6
python-tornado
Ubuntu:Pro:16.04:LTS
 before 4.2.1-1ubuntu3.1+esm3, plus listed versions
4.2.1-1ubuntu24.2.1-1ubuntu34.2.1-1ubuntu3.14.2.1-1ubuntu3.1+esm14.2.1-1ubuntu3.1+esm2
4.2.1-1ubuntu3.1+esm3
python-tornado
Ubuntu:Pro:18.04:LTS
 before 4.5.3-1ubuntu0.2+esm3, plus listed versions
4.5.1-2.1~build24.5.2-14.5.3-14.5.3-1ubuntu0.14.5.3-1ubuntu0.24.5.3-1ubuntu0.2+esm14.5.3-1ubuntu0.2+esm2
4.5.3-1ubuntu0.2+esm3
python-tornado
Ubuntu:Pro:22.04:LTS
 before 6.1.0-3ubuntu0.1~esm5, plus listed versions
6.1.0-1build16.1.0-26.1.0-36.1.0-3build16.1.0-3ubuntu0.1~esm16.1.0-3ubuntu0.1~esm26.1.0-3ubuntu0.1~esm4
6.1.0-3ubuntu0.1~esm5
python-tornado
Ubuntu:24.04:LTS
 before 6.4.0-1ubuntu0.5, plus listed versions
6.3.2-16.4.0-0ubuntu16.4.0-16.4.0-1build16.4.0-1ubuntu0.16.4.0-1ubuntu0.26.4.0-1ubuntu0.4
6.4.0-1ubuntu0.5
python-tornado
Ubuntu:25.10
 before 6.4.2-3ubuntu0.3, plus listed versions
6.4.2-16.4.2-26.4.2-2ubuntu16.4.2-36.4.2-3ubuntu0.2
6.4.2-3ubuntu0.3
python-tornado
Ubuntu:26.04:LTS
 before 6.5.4-0.1ubuntu0.1, plus listed versions
6.4.2-36.5.2-36.5.4-0.1
6.5.4-0.1ubuntu0.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-35536 is a high vulnerability (CVSS 7.2) in Tornadoweb Tornado, published March 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 15th percentile. Fixed in tornado 6.5.5.

References

Show 48 moreShow less
This page doesn't list everything

Left out here: 30 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open