Tornado versions before 6.6 do not validate the max_age argument of RequestHandler.set_cookie, which is also used by set_signed_cookie, set_secure_cookie, and clear_cookie. An attacker can craft a max_age value that injects additional Set‑Cookie attributes such as Domain, Path, or Secure. The injection expands the cookie’s scope to parent paths or other subdomains, thereby affecting the session cookie attributes controlled by the application.

The vulnerability applies to all releases of the Tornado web framework prior to version 6.6. Any application that uses Tornado’s set_cookie, set_signed_cookie, set_secure_cookie, or clear_cookie methods with unsanitized, attacker‑controlled input for the max_age parameter is at risk.

The CVSS score is 2.3, indicating low severity. No EPSS score is reported and the vulnerability is not listed in CISA’s KEV catalog, so the likelihood of widespread exploitation is modest. The attack vector requires an attacker to control the max_age input supplied by the application, which is typically obtained through normal application logic.