Update dependency tornado to v6.5.8 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
tornado (source)	6.5.7 → 6.5.8

---

Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive **kwargs path in set_cookie

GHSA-wwv5-g3v4-889x

More information

Details

Summary

The CVE-2026-35536 fix added a validation loop that rejects [\x00-\x20\x3b\x7f], but only for the
hardcoded lowercase keys name/domain/path/samesite. The still-live deprecated **kwargs path
writes attacker-supplied attribute values straight into the Morsel with no validation, and because
Morsel.__setitem__ is case-insensitive, a capitalized kwarg (Domain=, Path=, SameSite=, Max-Age=)
routes to the same reserved attribute while bypassing the loop — re-opening ;-delimited attribute injection.

self.set_cookie("sid", "abc", Domain="evil.com; Secure; SameSite=None")

#####  -> Set-Cookie: sid=abc; Domain=evil.com; Secure; SameSite=None; Path=/
##### Sanity (the canonical lowercase named arg IS blocked):
self.set_cookie("sid", "abc", domain="evil.com; Secure")   # -> http.cookies.CookieError

The patch's regression test (SetCookieForbiddenCharHandler) only exercises the four named params, never the
**kwargs path, so the gap is not regression-covered.

Affected code

• tornado/web.py → RequestHandler.set_cookie: the validation loop covers only the lowercase named args;
  the trailing if kwargs: loop does morsel[k] = v with no character validation.

Steps to reproduce

GET /upper (uses Domain= kwarg) emits Set-Cookie: c_upper=v; Domain=evil.com; Secure; SameSite=None; Path=/; GET /lower (uses lowercase
domain=) returns a CookieError.

Impact

Injection of independent cookie attributes (force/drop Secure/HttpOnly/SameSite, rebind Domain/Path)
— the same impact CVE-2026-35536 closed, via the sibling path the patch missed. Conditional on the app using
a capitalized/legacy keyword.

Suggested remediation

Apply the same [\x00-\x20\x3b\x7f] validation to every entry in the **kwargs loop (after normalizing the
key case), or remove the deprecated kwargs path; add a regression test for capitalized kwargs.

Credit

Reported as part of an incomplete-patch measurement study (responsible disclosure).

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/tornadoweb/tornado/security/advisories/GHSA-wwv5-g3v4-889x
• https://github.com/tornadoweb/tornado/pull/3704
• https://github.com/tornadoweb/tornado/pull/3706
• https://github.com/tornadoweb/tornado/commit/6ef836e43e1278530041376adb32504daa977b91
• https://github.com/tornadoweb/tornado/commit/da284767eae8e1f0484f123b8c3225f6465b09c7
• https://github.com/tornadoweb/tornado/releases/tag/v6.5.8
• https://github.com/advisories/GHSA-wwv5-g3v4-889x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

GHSA-8423-8fgw-73vq

More information

Details

Description

Summary

parse_multipart_form_data (httputil.py:34) calls
data.split(b"--"+boundary+b"\r\n") before the max_parts check (:35).
A 600KB body with 100k parts creates a 100k-element transient list first,
then rejects transient memory amplification (each split element is a copy).
Pre-auth HTTP DoS.

Root cause

parts = data[:final_boundary_index].split(b"--" + boundary + b"\r\n")  # :34  huge list first
if len(parts) > config.max_parts:                                       # :35  check after
    raise HTTPInputError("multipart/form-data has too many parts")

PoC

gist: https://gist.github.com/afldl/649861f25d39b53b7edbe0298e171617
poc.py + output.txt (100k parts from 600KB transient list).

Fix

Count separators without materializing the list (e.g. data.count(b"--"+boundary) first).

Credit

Reported by afldl, 2026-07.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq
• https://github.com/tornadoweb/tornado/pull/3704
• https://github.com/tornadoweb/tornado/commit/de85b3f87446e323e881bbaa3d5a74f4b76e5f05
• https://gist.github.com/afldl/649861f25d39b53b7edbe0298e171617
• https://github.com/tornadoweb/tornado/releases/tag/v6.5.8
• https://github.com/advisories/GHSA-8423-8fgw-73vq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

tornadoweb/tornado (tornado)

v6.5.8

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.