A vulnerability marked as critical has been reported in tornadoweb Tornado up to 6.5.4. The impacted element is the function
RequestHandler.set_cookie of the component Attributes Handler. Performing a manipulation of the argument samesite results in improper handling of invalid use of special elements.
This vulnerability is known as CVE-2026-35536. Remote exploitation of the attack is possible. No exploit is available.
It is suggested to upgrade the affected component.
