AIKIDO-2026-338003
tornado is vulnerable to HTTP Header Injection
37
Low Risk
This Affects:
tornadoTL;DR
RequestHandler.set_cookie validates the standard lowercase domain, path, and samesite arguments for forbidden characters, but the deprecated mixed-case keyword-argument path writes attribute values into the cookie without validation. Because the underlying cookie handling treats attribute keys case-insensitively, a capitalized keyword such as Domain reaches the same reserved attribute while bypassing the check. This reopens injection of additional cookie attributes through semicolons and control characters. The fix applies the same character validation to the deprecated keyword-argument path.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application calls set_cookie with a capitalized or legacy keyword argument such as Domain, Path, or SameSite.
Background info
tornado is vulnerable to HTTP Header Injection in versions 6.5.5 - 6.5.7.
How to fix this
Upgrade the tornado library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant