The vulnerability allows an attacker to inject arbitrary cookie attributes when the set_cookie method of Tornado’s RequestHandler receives unvalidated domain, path, or samesite values. This can enable manipulation of session cookies, facilitating session fixation, cookie hijacking, or cross‑site request forgery by setting attributes that change how browsers handle the cookie. The weakness corresponds to CWE‑159, which involves unexpected or unsafe handling of input data. The impact is limited to the integrity and confidentiality of user sessions, as the attacker can influence cookie behavior without executing arbitrary code.

All versions of Tornado older than 6.5.5 are affected. The vulnerability exists in the Tornado web framework itself, where the set_cookie method does not sanitize input for cookie attributes. Users deploying Tornado 6.5.5 or newer are not vulnerable.

With a CVSS score of 7.2, the issue is classified as high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack path is inferred to be remote, via crafted HTTP requests that invoke the set_cookie method. Although there is no direct code execution, the ability to alter cookie characteristics poses a significant risk to session management and may be leveraged in broader attacks such as session fixation or CSRF. Institutions should treat this as a high‑priority security concern.