diff --git a/meta-python/recipes-devtools/python/python3-tornado/CVE-2026-91991.patch b/meta-python/recipes-devtools/python/python3-tornado/CVE-2026-91991.patch
new file mode 100644
index 0000000000..6bd755af57
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-tornado/CVE-2026-91991.patch
@@ -0,0 +1,57 @@
+From 566a5ff64a530dfbc6bb6afbb1615c3e7addfd8d Mon Sep 17 00:00:00 2001
+From: Ben Darnell <ben@bendarnell.com>
+Date: Wed, 5 Aug 2026 21:33:26 -0400
+Subject: [PATCH] web: Also check for semicolons in deprecated mixed-case
+ cookie args
+
+(cherry picked from commit da284767eae8e1f0484f123b8c3225f6465b09c7)
+
+CVE: CVE-2026-91991
+Upstream-Status: Backport [https://github.com/tornadoweb/tornado/commit/da284767eae8e1f0484f123b8c3225f6465b09c7]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ tornado/test/web_test.py | 12 ++++++++++++
+ tornado/web.py           |  6 ++++++
+ 2 files changed, 18 insertions(+)
+
+diff --git a/tornado/test/web_test.py b/tornado/test/web_test.py
+index 9bd1d49c..27e7fcfe 100644
+--- a/tornado/test/web_test.py
++++ b/tornado/test/web_test.py
+@@ -329,6 +329,18 @@ class CookieTest(WebTestCase):
+                                 "unexpected exception for char %r in domain: %s\n"
+                                 % (char, e)
+                             )
++                    try:
++                        self.set_cookie("foo", "bar", DoMaIn="example" + char + ".com")
++                        self.write(
++                            "Didn't get expected exception for char %r in DoMaIn\n"
++                            % char
++                        )
++                    except http.cookies.CookieError as e:
++                        if "Invalid cookie attribute DoMaIn" not in str(e):
++                            self.write(
++                                "unexpected exception for char %r in DoMaIn: %s\n"
++                                % (char, e)
++                            )
+ 
+                     try:
+                         self.set_cookie("foo", "bar", path="/" + char)
+diff --git a/tornado/web.py b/tornado/web.py
+index ec7ec3f5..6f1ae304 100644
+--- a/tornado/web.py
++++ b/tornado/web.py
+@@ -717,6 +717,12 @@ class RequestHandler:
+                 raise http.cookies.CookieError(
+                     f"Invalid cookie attribute {attr_name}={attr_value!r} for cookie {name!r}"
+                 )
++        for k, v in kwargs.items():
++            # Also check for disallowed characters in deprecated kwargs.
++            if re.search(r"[\x00-\x20\x3b\x7f]", str(v)):
++                raise http.cookies.CookieError(
++                    f"Invalid cookie attribute {k}={v!r} for cookie {name!r}"
++                )
+         if not hasattr(self, "_new_cookie"):
+             self._new_cookie = (
+                 http.cookies.SimpleCookie()
diff --git a/meta-python/recipes-devtools/python/python3-tornado_6.5.7.bb b/meta-python/recipes-devtools/python/python3-tornado_6.5.7.bb
index bb85d8e8a2..332d5875e6 100644
--- a/meta-python/recipes-devtools/python/python3-tornado_6.5.7.bb
+++ b/meta-python/recipes-devtools/python/python3-tornado_6.5.7.bb
@@ -10,6 +10,7 @@ SRC_URI[sha256sum] = "66c513a76cda70d53907bc27cf1447557699c2e95aa48ba27a442ff61c
 
 SRC_URI += "file://CVE-2026-91990.patch \
             file://CVE-2026-82397.patch \
+            file://CVE-2026-91991.patch \
 "
 
 inherit pypi python_setuptools_build_meta