The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-tornado | May 6, 2026 | May 5, 2026 |
| Amazon Linux Ami 2 | — | Upgrade python-tornado-docUpgrade python3-tornadoUpgrade python3-tornado-debuginfoUpgrade python-tornadoUpgrade python-tornado-debuginfoUpgrade python3-tornado-doc | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade python3.13-tornado-debuginfoUpgrade python-tornado-docUpgrade python3.13-tornado-docUpgrade python3-tornado-debuginfoUpgrade python3.13-tornado-debugsourceUpgrade python3.13-tornadoUpgrade python3-tornadoUpgrade python-tornado-debugsource | May 4, 2026 | Apr 3, 2026 |
| Debian | — | Upgrade python-tornado | Apr 6, 2026 | Apr 6, 2026 |
| Oracle_linux | — | Upgrade python-tornado-docUpgrade python3-tornadoUpgrade python-tornado | May 6, 2026 | Apr 3, 2026 |
| Redhat_linux | — | Upgrade python3-tornadoUpgrade python-tornado-docUpgrade python-tornado-debuginfoUpgrade python3-tornado-debuginfoUpgrade python-tornadoUpgrade python-tornado-debugsource | May 7, 2026 | Apr 3, 2026 |
| Rocky_linux | — | Upgrade python3-tornado-debuginfoUpgrade python-tornado-debugsourceUpgrade python3-tornado | May 11, 2026 | May 6, 2026 |
| Ubuntu | — | Upgrade python-tornado (Ubuntu Pro)Upgrade python3-tornado (Ubuntu Pro)Upgrade python3-tornado | Apr 23, 2026 | Apr 3, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Apr 3, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub