Medium5.4Red Hat & Ubuntu Linux

Cookie attribute injection due to improper handling of cookie arguments

CVE-2026-35536 Published Apr 3, 2026

CVE-2026-35536

Affected products & platforms

Red Hat & Ubuntu LinuxUnclassified

Summary

Cookie attribute injection due to improper handling of cookie arguments. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-88. Affected package(s): python-tornado. Resolved in Red Hat advisory RHSA-2026:24342 — update the affected packages (`sudo dnf update`).

Affected versions

python-tornado-0:6.4.2-1.el10_0.2
python-tornado-0:6.5.5-1.el10_1.1
python-tornado-0:6.4.2-2.el9_6.3
python-tornado-0:4.2.1-5.el7_9.3
python-tornado-0:6.5.5-1.el9_7.1
python-tornado-0:6.5.5-1.el9_8
python-tornado-0:6.4.2-1.el9_2.2
python-tornado-0:6.5.5-1.el10_2
python-tornado-0:6.4.2-1.el9_4.2

Official advisory · high-confidence parse· fetched 5 hours ago·verify at source

Fixed versions

RHSA-2026:24342

Official advisory · high-confidence parse· fetched 5 hours ago·verify at source

Mitigation checklist

Recommended fix / mitigation

Update the affected package(s) to the fixed version shipped in RHSA-2026:24342 (`sudo dnf update` / `yum update`).

Official advisory · high-confidence parse· fetched 5 hours ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.