TornadoWebServer Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response (CVE-2026-91991)
Description
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.