Bug 2568697 (CVE-2026-123535)

Summary: CVE-2026-123535 tornado: tornado: Cookie attribute injection via unvalidated max_age parameter
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, anpicker, aos-team-art-private, asdas, bbrownin, dpaolell, ebourniv, eglynn, hasun, jdelft, jfula, jjoyce, jlanda, jowilson, jpretori, jschluet, jupierce, jwong, kshier, lgarciaa, lhh, mbiarnes, mburns, mgarciac, nyancey, ometelka, ppalepu, ppostler, prdhamdh, ptisnovs, rbobbitt, rhel-process-autobot, sbunciak, sghai, sidsharm, simaishi, stcannon, suppawar, syedriko, tguha, vlaad, watson-tool-maintainers, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Tornado. Cookie handling functions fail to properly validate the max_age parameter against untrusted input, allowing an attacker to inject arbitrary attributes into the Set-Cookie HTTP response header. A remote attacker could exploit this vulnerability to alter cookie security flags or expand a cookie's scope to unintended subdomains and paths, potentially compromising sensitive session information.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-08 01:53:04 UTC 
Tornado before 6.6 does not validate the max_age argument of RequestHandler.set_cookie (also called by set_signed_cookie, set_secure_cookie, and clear_cookie), allowing injection of additional Set-Cookie attributes. When an application passes attacker-influenced input as max_age, an attacker can embed attributes such as Domain, Path, or Secure to widen the cookie's scope to parent paths or other subdomains.