Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
TornadoWebServer Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Request/Response - CVE-2026-91991 - Vulnerability Database
Tornado

TornadoWebServer Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Request/Response - CVE-2026-91991

Medium
Reference: CVE-2026-91991
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-91991
Title: TornadoWebServer Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Request/Response
Overview:

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain Path or SameSite to bypass validation and modify cookie security attributes.