Vulnerability-Lookup

OPENSUSE-SU-2026:10708-1

Vulnerability from csaf_opensuse - Published: 2026-05-06 00:00 - Updated: 2026-05-06 00:00

Summary

python311-Django4-4.2.30-2.1 on GA media

Severity

Moderate

Notes

Title of the patch: python311-Django4-4.2.30-2.1 on GA media

Description of the patch: These are all security issues fixed in the python311-Django4-4.2.30-2.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-10708

CVE-2026-35192

4.2 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

CVE-2026-5766

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

CVE-2026-6907

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

References

URL

Category

	https://www.suse.com/support/security/rating/	external
	https://ftp.suse.com/pub/projects/security/csaf/o…	self
	https://www.suse.com/security/cve/CVE-2026-35192/	self
	https://www.suse.com/security/cve/CVE-2026-5766/	self
	https://www.suse.com/security/cve/CVE-2026-6907/	self
	https://www.suse.com/security/cve/CVE-2026-35192	external
	https://bugzilla.suse.com/1264154	external
	https://www.suse.com/security/cve/CVE-2026-5766	external
	https://bugzilla.suse.com/1264153	external
	https://www.suse.com/security/cve/CVE-2026-6907	external
	https://bugzilla.suse.com/1264152	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "python311-Django4-4.2.30-2.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the python311-Django4-4.2.30-2.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10708",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10708-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-35192 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-35192/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-5766 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-5766/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-6907 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-6907/"
      }
    ],
    "title": "python311-Django4-4.2.30-2.1 on GA media",
    "tracking": {
      "current_release_date": "2026-05-06T00:00:00Z",
      "generator": {
        "date": "2026-05-06T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10708-1",
      "initial_release_date": "2026-05-06T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-05-06T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-Django4-4.2.30-2.1.aarch64",
                "product": {
                  "name": "python311-Django4-4.2.30-2.1.aarch64",
                  "product_id": "python311-Django4-4.2.30-2.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-Django4-4.2.30-2.1.aarch64",
                "product": {
                  "name": "python313-Django4-4.2.30-2.1.aarch64",
                  "product_id": "python313-Django4-4.2.30-2.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python314-Django4-4.2.30-2.1.aarch64",
                "product": {
                  "name": "python314-Django4-4.2.30-2.1.aarch64",
                  "product_id": "python314-Django4-4.2.30-2.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-Django4-4.2.30-2.1.ppc64le",
                "product": {
                  "name": "python311-Django4-4.2.30-2.1.ppc64le",
                  "product_id": "python311-Django4-4.2.30-2.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python313-Django4-4.2.30-2.1.ppc64le",
                "product": {
                  "name": "python313-Django4-4.2.30-2.1.ppc64le",
                  "product_id": "python313-Django4-4.2.30-2.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python314-Django4-4.2.30-2.1.ppc64le",
                "product": {
                  "name": "python314-Django4-4.2.30-2.1.ppc64le",
                  "product_id": "python314-Django4-4.2.30-2.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-Django4-4.2.30-2.1.s390x",
                "product": {
                  "name": "python311-Django4-4.2.30-2.1.s390x",
                  "product_id": "python311-Django4-4.2.30-2.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python313-Django4-4.2.30-2.1.s390x",
                "product": {
                  "name": "python313-Django4-4.2.30-2.1.s390x",
                  "product_id": "python313-Django4-4.2.30-2.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python314-Django4-4.2.30-2.1.s390x",
                "product": {
                  "name": "python314-Django4-4.2.30-2.1.s390x",
                  "product_id": "python314-Django4-4.2.30-2.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-Django4-4.2.30-2.1.x86_64",
                "product": {
                  "name": "python311-Django4-4.2.30-2.1.x86_64",
                  "product_id": "python311-Django4-4.2.30-2.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-Django4-4.2.30-2.1.x86_64",
                "product": {
                  "name": "python313-Django4-4.2.30-2.1.x86_64",
                  "product_id": "python313-Django4-4.2.30-2.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python314-Django4-4.2.30-2.1.x86_64",
                "product": {
                  "name": "python314-Django4-4.2.30-2.1.x86_64",
                  "product_id": "python314-Django4-4.2.30-2.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Django4-4.2.30-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.aarch64"
        },
        "product_reference": "python311-Django4-4.2.30-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Django4-4.2.30-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.ppc64le"
        },
        "product_reference": "python311-Django4-4.2.30-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Django4-4.2.30-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.s390x"
        },
        "product_reference": "python311-Django4-4.2.30-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Django4-4.2.30-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.x86_64"
        },
        "product_reference": "python311-Django4-4.2.30-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Django4-4.2.30-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.aarch64"
        },
        "product_reference": "python313-Django4-4.2.30-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Django4-4.2.30-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.ppc64le"
        },
        "product_reference": "python313-Django4-4.2.30-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Django4-4.2.30-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.s390x"
        },
        "product_reference": "python313-Django4-4.2.30-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Django4-4.2.30-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.x86_64"
        },
        "product_reference": "python313-Django4-4.2.30-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Django4-4.2.30-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.aarch64"
        },
        "product_reference": "python314-Django4-4.2.30-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Django4-4.2.30-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.ppc64le"
        },
        "product_reference": "python314-Django4-4.2.30-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Django4-4.2.30-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.s390x"
        },
        "product_reference": "python314-Django4-4.2.30-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Django4-4.2.30-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.x86_64"
        },
        "product_reference": "python314-Django4-4.2.30-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-35192",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-35192"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.\nResponse headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user\u0027s session after that user visits a cached public page.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.aarch64",
          "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.ppc64le",
          "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.s390x",
          "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.x86_64",
          "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.aarch64",
          "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.ppc64le",
          "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.s390x",
          "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.x86_64",
          "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.aarch64",
          "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.ppc64le",
          "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.s390x",
          "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-35192",
          "url": "https://www.suse.com/security/cve/CVE-2026-35192"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264154 for CVE-2026-35192",
          "url": "https://bugzilla.suse.com/1264154"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.aarch64",
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.ppc64le",
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.s390x",
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.x86_64",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.aarch64",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.ppc64le",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.s390x",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.x86_64",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.aarch64",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.ppc64le",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.s390x",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.aarch64",
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.ppc64le",
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.s390x",
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.x86_64",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.aarch64",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.ppc64le",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.s390x",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.x86_64",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.aarch64",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.ppc64le",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.s390x",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-35192"
    },
    {
      "cve": "CVE-2026-5766",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-5766"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.\nASGI requests with a missing or understated `Content-Length` header can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit, potentially loading large files into memory and causing service degradation.\r\n \r\nAs a reminder, Django expects a limit to be configured at the web server level rather than solely relying on `FILE_UPLOAD_MAX_MEMORY_SIZE`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Kyle Agronick for reporting this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.aarch64",
          "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.ppc64le",
          "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.s390x",
          "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.x86_64",
          "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.aarch64",
          "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.ppc64le",
          "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.s390x",
          "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.x86_64",
          "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.aarch64",
          "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.ppc64le",
          "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.s390x",
          "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-5766",
          "url": "https://www.suse.com/security/cve/CVE-2026-5766"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264153 for CVE-2026-5766",
          "url": "https://bugzilla.suse.com/1264153"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.aarch64",
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.ppc64le",
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.s390x",
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.x86_64",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.aarch64",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.ppc64le",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.s390x",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.x86_64",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.aarch64",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.ppc64le",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.s390x",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.aarch64",
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.ppc64le",
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.s390x",
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.x86_64",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.aarch64",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.ppc64le",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.s390x",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.x86_64",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.aarch64",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.ppc64le",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.s390x",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-5766"
    },
    {
      "cve": "CVE-2026-6907",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-6907"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.\n`django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`\u0027*\u0027`). This can lead to private data being stored and served.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Ahmad Sadeddin for reporting this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.aarch64",
          "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.ppc64le",
          "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.s390x",
          "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.x86_64",
          "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.aarch64",
          "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.ppc64le",
          "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.s390x",
          "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.x86_64",
          "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.aarch64",
          "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.ppc64le",
          "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.s390x",
          "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-6907",
          "url": "https://www.suse.com/security/cve/CVE-2026-6907"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264152 for CVE-2026-6907",
          "url": "https://bugzilla.suse.com/1264152"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.aarch64",
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.ppc64le",
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.s390x",
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.x86_64",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.aarch64",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.ppc64le",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.s390x",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.x86_64",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.aarch64",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.ppc64le",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.s390x",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.aarch64",
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.ppc64le",
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.s390x",
            "openSUSE Tumbleweed:python311-Django4-4.2.30-2.1.x86_64",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.aarch64",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.ppc64le",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.s390x",
            "openSUSE Tumbleweed:python313-Django4-4.2.30-2.1.x86_64",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.aarch64",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.ppc64le",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.s390x",
            "openSUSE Tumbleweed:python314-Django4-4.2.30-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-6907"
    }
  ]
}

CVE-2026-5766 (GCVE-0-2026-5766)

Vulnerability from cvelistv5 – Published: 2026-05-05 14:49 – Updated: 2026-05-06 15:25

Title

Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass

Summary

An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated `Content-Length` header can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit, potentially loading large files into memory and causing service degradation. As a reminder, Django expects a limit to be configured at the web server level rather than solely relying on `FILE_UPLOAD_MAX_MEMORY_SIZE`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kyle Agronick for reporting this issue.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CWE

CWE-130 - Improper Handling of Length Parameter Inconsistency

Assigner

DSF

References

URL

Tags

	https://docs.djangoproject.com/en/dev/releases/se…	vendor-advisory
	https://groups.google.com/g/django-announce	mailing-list
	https://www.djangoproject.com/weblog/2026/may/05/…	vendor-advisory

Impacted products

	Vendor	Product	Version
	djangoproject	Django	Affected: 6.0 , < 6.0.5 (python) Unaffected: 6.0.5 (python) Affected: 5.2 , < 5.2.14 (python) Unaffected: 5.2.14 (python)

Date Public ?

2026-05-05 09:00

Credits

Kyle Agronick Jacob Walls Sarah Boyce

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-5766",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-05T17:03:20.935294Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-06T15:25:38.926Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.org/project/Django/",
          "defaultStatus": "unaffected",
          "packageName": "django",
          "product": "Django",
          "repo": "https://github.com/django/django/",
          "vendor": "djangoproject",
          "versions": [
            {
              "lessThan": "6.0.5",
              "status": "affected",
              "version": "6.0",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "6.0.5",
              "versionType": "python"
            },
            {
              "lessThan": "5.2.14",
              "status": "affected",
              "version": "5.2",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "5.2.14",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Kyle Agronick"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jacob Walls"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Sarah Boyce"
        }
      ],
      "datePublic": "2026-05-05T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.\u003c/p\u003e\u003cp\u003eASGI requests with a missing or understated `Content-Length` header can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit, potentially loading large files into memory and causing service degradation.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eAs a reminder, Django expects a limit to be configured at the web server level rather than solely relying on `FILE_UPLOAD_MAX_MEMORY_SIZE`.\u003c/p\u003e\u003cp\u003eEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\u003c/p\u003e\u003cp\u003eDjango would like to thank Kyle Agronick for reporting this issue.\u003c/p\u003e"
            }
          ],
          "value": "An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.\nASGI requests with a missing or understated `Content-Length` header can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit, potentially loading large files into memory and causing service degradation.\r\n \r\nAs a reminder, Django expects a limit to be configured at the web server level rather than solely relying on `FILE_UPLOAD_MAX_MEMORY_SIZE`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Kyle Agronick for reporting this issue."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130: Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels",
              "value": "low"
            },
            "type": "Django severity rating"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-130",
              "description": "CWE-130: Improper Handling of Length Parameter Inconsistency",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-05T14:49:19.715Z",
        "orgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
        "shortName": "DSF"
      },
      "references": [
        {
          "name": "Django security archive",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.djangoproject.com/en/dev/releases/security/"
        },
        {
          "name": "Django releases announcements",
          "tags": [
            "mailing-list"
          ],
          "url": "https://groups.google.com/g/django-announce"
        },
        {
          "name": "Django security releases issued: 6.0.5 and 5.2.14",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.djangoproject.com/weblog/2026/may/05/security-releases/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2024-05-12T10:32:17.000Z",
          "value": "Initial report received."
        },
        {
          "lang": "en",
          "time": "2026-04-07T10:32:20.000Z",
          "value": "Vulnerability confirmed."
        },
        {
          "lang": "en",
          "time": "2026-05-05T09:00:00.000Z",
          "value": "Security release issued."
        }
      ],
      "title": "Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
    "assignerShortName": "DSF",
    "cveId": "CVE-2026-5766",
    "datePublished": "2026-05-05T14:49:19.715Z",
    "dateReserved": "2026-04-07T19:29:07.042Z",
    "dateUpdated": "2026-05-06T15:25:38.926Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6907 (GCVE-0-2026-6907)

Vulnerability from cvelistv5 – Published: 2026-05-05 14:50 – Updated: 2026-05-06 15:25

Title

Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware

Summary

An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmad Sadeddin for reporting this issue.

Severity ?

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-524 - Use of Cache Containing Sensitive Information

Assigner

DSF

References

URL

Tags

	https://docs.djangoproject.com/en/dev/releases/se…	vendor-advisory
	https://groups.google.com/g/django-announce	mailing-list
	https://www.djangoproject.com/weblog/2026/may/05/…	vendor-advisory

Impacted products

	Vendor	Product	Version
	djangoproject	Django	Affected: 6.0 , < 6.0.5 (python) Unaffected: 6.0.5 (python) Affected: 5.2 , < 5.2.14 (python) Unaffected: 5.2.14 (python)

Date Public ?

2026-05-05 09:00

Credits

Ahmad Sadeddin Sarah Boyce Sarah Boyce

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6907",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-05T17:03:42.610418Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-06T15:25:33.698Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.org/project/Django/",
          "defaultStatus": "unaffected",
          "packageName": "django",
          "product": "Django",
          "repo": "https://github.com/django/django/",
          "vendor": "djangoproject",
          "versions": [
            {
              "lessThan": "6.0.5",
              "status": "affected",
              "version": "6.0",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "6.0.5",
              "versionType": "python"
            },
            {
              "lessThan": "5.2.14",
              "status": "affected",
              "version": "5.2",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "5.2.14",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ahmad Sadeddin"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Sarah Boyce"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Sarah Boyce"
        }
      ],
      "datePublic": "2026-05-05T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.\u003c/p\u003e\u003cp\u003e`django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`\u0026#x27;*\u0026#x27;`). This can lead to private data being stored and served.\u003c/p\u003e\u003cp\u003eEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\u003c/p\u003e\u003cp\u003eDjango would like to thank Ahmad Sadeddin for reporting this issue.\u003c/p\u003e"
            }
          ],
          "value": "An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.\n`django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`\u0027*\u0027`). This can lead to private data being stored and served.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Ahmad Sadeddin for reporting this issue."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-204",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-204: Lifting Sensitive Data Embedded in Cache"
            }
          ]
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels",
              "value": "low"
            },
            "type": "Django severity rating"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-524",
              "description": "CWE-524: Use of Cache Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-05T14:50:02.594Z",
        "orgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
        "shortName": "DSF"
      },
      "references": [
        {
          "name": "Django security archive",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.djangoproject.com/en/dev/releases/security/"
        },
        {
          "name": "Django releases announcements",
          "tags": [
            "mailing-list"
          ],
          "url": "https://groups.google.com/g/django-announce"
        },
        {
          "name": "Django security releases issued: 6.0.5 and 5.2.14",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.djangoproject.com/weblog/2026/may/05/security-releases/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-03-06T10:17:03.000Z",
          "value": "Initial report received."
        },
        {
          "lang": "en",
          "time": "2026-04-23T10:17:26.000Z",
          "value": "Vulnerability confirmed."
        },
        {
          "lang": "en",
          "time": "2026-05-05T09:00:00.000Z",
          "value": "Security release issued."
        }
      ],
      "title": "Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
    "assignerShortName": "DSF",
    "cveId": "CVE-2026-6907",
    "datePublished": "2026-05-05T14:50:02.594Z",
    "dateReserved": "2026-04-23T11:19:30.877Z",
    "dateUpdated": "2026-05-06T15:25:33.698Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-35192 (GCVE-0-2026-35192)

Vulnerability from cvelistv5 – Published: 2026-05-05 14:50 – Updated: 2026-05-06 15:25

Title

Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST

Summary

An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that user visits a cached public page. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.

Severity ?

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-539 - Use of Persistent Cookies Containing Sensitive Information

Assigner

DSF

References

URL

Tags

	https://docs.djangoproject.com/en/dev/releases/se…	vendor-advisory
	https://groups.google.com/g/django-announce	mailing-list
	https://www.djangoproject.com/weblog/2026/may/05/…	vendor-advisory

Impacted products

	Vendor	Product	Version
	djangoproject	Django	Affected: 6.0 , < 6.0.5 (python) Unaffected: 6.0.5 (python) Affected: 5.2 , < 5.2.14 (python) Unaffected: 5.2.14 (python)

Date Public ?

2026-05-05 09:00

Credits

Cantina Jake Howard Sarah Boyce

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-35192",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-05T17:04:02.535125Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-06T15:25:28.432Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.org/project/Django/",
          "defaultStatus": "unaffected",
          "packageName": "django",
          "product": "Django",
          "repo": "https://github.com/django/django/",
          "vendor": "djangoproject",
          "versions": [
            {
              "lessThan": "6.0.5",
              "status": "affected",
              "version": "6.0",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "6.0.5",
              "versionType": "python"
            },
            {
              "lessThan": "5.2.14",
              "status": "affected",
              "version": "5.2",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "5.2.14",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Cantina"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jake Howard"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Sarah Boyce"
        }
      ],
      "datePublic": "2026-05-05T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.\u003c/p\u003e\u003cp\u003eResponse headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user\u0026#x27;s session after that user visits a cached public page.\u003c/p\u003e\u003cp\u003eEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\u003c/p\u003e\u003cp\u003eDjango would like to thank Cantina for reporting this issue.\u003c/p\u003e"
            }
          ],
          "value": "An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.\nResponse headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user\u0027s session after that user visits a cached public page.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-60",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-60: Reusing Session IDs (aka Session Replay)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels",
              "value": "low"
            },
            "type": "Django severity rating"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-539",
              "description": "CWE-539: Use of Persistent Cookies Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-05T14:50:29.984Z",
        "orgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
        "shortName": "DSF"
      },
      "references": [
        {
          "name": "Django security archive",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.djangoproject.com/en/dev/releases/security/"
        },
        {
          "name": "Django releases announcements",
          "tags": [
            "mailing-list"
          ],
          "url": "https://groups.google.com/g/django-announce"
        },
        {
          "name": "Django security releases issued: 6.0.5 and 5.2.14",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.djangoproject.com/weblog/2026/may/05/security-releases/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-03-11T10:54:40.000Z",
          "value": "Initial report received."
        },
        {
          "lang": "en",
          "time": "2026-04-01T10:54:43.000Z",
          "value": "Vulnerability confirmed."
        },
        {
          "lang": "en",
          "time": "2026-05-05T09:00:00.000Z",
          "value": "Security release issued."
        }
      ],
      "title": "Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
    "assignerShortName": "DSF",
    "cveId": "CVE-2026-35192",
    "datePublished": "2026-05-05T14:50:29.984Z",
    "dateReserved": "2026-04-01T18:21:23.779Z",
    "dateUpdated": "2026-05-06T15:25:28.432Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

OPENSUSE-SU-2026:10708-1

CVE-2026-5766 (GCVE-0-2026-5766)

CVE-2026-6907 (GCVE-0-2026-6907)

CVE-2026-35192 (GCVE-0-2026-35192)

Tags

Sightings

Nomenclature