{"vulnerability": "CVE-2026-35536", "sightings": [{"uuid": "d8982c56-df0d-4d73-ae15-3bbe552e06fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-35536", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miktqoyjm523", "content": "", "creation_timestamp": "2026-04-03T04:05:27.551596Z"}, {"uuid": "05eae2e1-81cc-48c5-8fb3-dd6e6a761ab0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-35536", "type": "published-proof-of-concept", "source": "Telegram/pXUM2jaw9GgU28Sl0meXOcFoAiVepufvCfRhEfvGcf7OCXo", "content": "", "creation_timestamp": "2026-04-03T05:15:36.000000Z"}, {"uuid": "6155d5af-8af7-4419-a9e4-46658fd9bdcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-35536", "type": "seen", "source": "https://gist.github.com/alon710/2024cdfc47e5cc83e297e4766f1b03a2", "content": "# GHSA-WWV5-G3V4-889X: GHSA-wwv5-g3v4-889x: Cookie Attribute Injection in Tornado via Legacy Case-Insensitive kwargs\n\n> **CVSS Score:** 2.3\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/GHSA-WWV5-G3V4-889X\n\n## Summary\nAn incomplete sanitization fix for CVE-2026-35536 in Tornado allowed cookie attribute injection. The framework's validation loop checked lowercase keyword arguments but neglected legacy case-insensitive parameters passed through arbitrary keyword arguments, which Python's underlying library parses case-insensitively.\n\n## TL;DR\nTornado's cookie validation bypassed legacy case-insensitive kwargs, allowing arbitrary attribute injection.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-74\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 2.3 (Low)\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **KEV Status**: Not Listed\n- **Impact**: Cookie Attribute Injection / Security Policy Bypass\n\n## Affected Systems\n\n- Tornado web server applications using mixed-case cookie parameters (versions >= 6.5.5, < 6.5.8)\n- **tornado**: >= 6.5.5, < 6.5.8 (Fixed in: `6.5.8`)\n\n## Mitigation\n\n- Upgrade to Tornado version 6.5.8 or higher.\n- Refactor all codebase instances of `set_cookie` to use explicit lowercase parameter names.\n- Apply manual regex filters to any parameters dynamically passed to legacy wrapper functions.\n\n**Remediation Steps:**\n1. Run automated codebase scans to find calls to `set_cookie` containing capitalized parameters.\n2. Update requirements files to pin `tornado>=6.5.8`.\n3. Rebuild and redeploy application containers.\n4. Verify cookie headers generated by the application do not contain unvalidated user payload blocks.\n\n## References\n\n- [GitHub Security Advisory GHSA-wwv5-g3v4-889x](https://github.com/advisories/GHSA-wwv5-g3v4-889x)\n- [Tornado Security Advisory](https://github.com/tornadoweb/tornado/security/advisories/GHSA-wwv5-g3v4-889x)\n- [Tornado Pull Request 3704](https://github.com/tornadoweb/tornado/pull/3704)\n- [Tornado Pull Request 3706](https://github.com/tornadoweb/tornado/pull/3706)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-WWV5-G3V4-889X) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T14:33:48.371282Z"}]}